diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml
index 218429fef1..21bfff382e 100644
--- a/detections/deprecated/detection_of_dns_tunnels.yml
+++ b/detections/deprecated/detection_of_dns_tunnels.yml
@@ -6,20 +6,18 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Network_Resolution
-description: This search is used to detect DNS tunneling, by calculating the sum of
-  the length of DNS queries and DNS answers. The search also filters out potential
+description: 'This search is used to detect DNS tunneling, by calculating the sum
+  of the length of DNS queries and DNS answers. The search also filters out potential
   false positives by filtering out queries made to internal systems and the queries
   originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
   method of transmission for data exfiltration, command and control, or evasion of
   security controls can often be detected by noting an unusually large volume of DNS
   traffic. \
 
-  NOTE:Deprecated because existing detection is doing the same. This detection is 
-  replaced with two other variations, if you are using MLTK then you can use this 
-  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard 
-  deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, 
-  as an alternantive.   
-   
+  NOTE:Deprecated because existing detection is doing the same. This detection is
+  replaced with two other variations, if you are using MLTK then you can use this
+  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation
+  version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.'
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT
   (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"
diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 20168a30e2..34dd2735d6 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -15,10 +15,10 @@ description: Certutil.exe may download a file from a remote destination using `-
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
-  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.original_file_name
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
+  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index 65fef131a1..1a61ded17f 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -15,10 +15,10 @@ description: 'Certutil.exe may download a file from a remote destination using `
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
-  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
+  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
+  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 59ea163e8c..0b1bb8f3ea 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -20,8 +20,12 @@ description: 'The following analytic identifies the use of the EncodedCommand Po
   on admin scripts in use. \
 
   Alternatively, may use regex per matching here https://regexr.com/662ov.'
-search: 
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
index b182cf705a..c6cf21808e 100644
--- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
@@ -15,8 +15,12 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: 
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index fe6f69d903..39ea9b205b 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -6,24 +6,29 @@ author: Michael Haag, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may
-  abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice
-  executing directly, may avoid triggering security tools that may not monitor execution
-  of the rundll32.exe process because of allowlists or false positives from normal
-  operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
+description: The following analytic identifies rundll32.exe loading an export function
+  by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious
+  code. Using rundll32.exe, vice executing directly, may avoid triggering security
+  tools that may not monitor execution of the rundll32.exe process because of allowlists
+  or false positives from normal operations. Utilizing ordinal values makes it a bit
+  more complicated for analysts to understand the behavior until the DLL is reviewed.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`'
+  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") |
+  `rundll_loading_dll_by_ordinal_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+known_false_positives: False positives are possible with native utilities and third
+  party applications. Filtering may be needed based on command-line, or add world
+  writeable paths to restrict query.
 references:
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ 
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes
diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index b07c391fab..8c4e9e2a4f 100644
--- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -15,17 +15,21 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: '| from read_ssa_enriched_events()
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
-| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where match_regex(cmd_line, /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true 
-| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
-| into write_ssa_detected_events();'
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line,
+  /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval
+  start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -58,7 +62,8 @@ tags:
   kill_chain_phases:
   - Exfiltration
   message: PowerShell processes $process$ started with parameters to modify the execution
-    policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
+    policy of the run, run in a hidden window, and connect to the Internet on host
+    $dest$ executed by user $user$.
   mitre_attack_id:
   - T1020
   nist:
diff --git a/detections/endpoint/ssa___windows_powershell_downloadfile.yml b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
index 9708f9299e..939778867e 100644
--- a/detections/endpoint/ssa___windows_powershell_downloadfile.yml
+++ b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
@@ -11,17 +11,20 @@ description: The following analytic identifies the use of PowerShell downloading
   PowerShell frameworks to download files and output to disk. Identify the source
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
-search: '| from read_ssa_enriched_events()
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
-| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where (like (cmd_line, "%downloadfile%"))
-| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
-| into write_ssa_detected_events();'
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -50,7 +53,9 @@ tags:
   impact: 50
   kill_chain_phases:
   - Lateral Movement
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
+    within PowerShell.
   mitre_attack_id:
   - T1020
   nist:
diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
index 5cd5622126..1478210a41 100644
--- a/detections/endpoint/windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -6,57 +6,46 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
-  During triage, review parent and child process behavior including file and image loads.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_rasautou_dll_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+description: The following analytic identifies the Windows Windows Remote Auto Dialer,
+  rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
+  shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
+  parent and child process behavior including file and image loads.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe
+  Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
 references:
-  - https://github.com/mandiant/DueDLLigence
-  - https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
-  - https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 
-  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to load a DLL in a suspicious manner.
   mitre_attack_id:
   - T1055.001
   - T1218
   - T1055
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
   observable:
   - name: dest
     type: Hostname
@@ -69,4 +58,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index 55a49c7865..723eeca63c 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -6,54 +6,43 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected.
-  This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+description: The following analytic identifies the use of Microsoft Remote Assistance,
+  msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default
+  has no command-line arguments and typically spawns itself. It will generate a network
+  connection to the remote system that is connected. This behavior is indicative of
+  another process injected into msra.exe. Review the parent process or cross process
+  events to identify source.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe
-  `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  `windows_shells` by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives should be limited, filter as needed. Add additional shells as needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, filter as needed. Add additional
+  shells as needed.
 references:
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1055
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$, generating behavior not common with msra.exe.
+  mitre_attack_id:
+  - T1055
   observable:
   - name: dest
     type: Hostname
@@ -66,4 +55,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index c7fff79e68..aa37903127 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -6,58 +6,44 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. 
-  This is commonly used by adversaries to spawn a process in an elevated state. 
+description: The following analytic identifies Schtasks.exe creating a new task to
+  start and run as an elevated user - SYSTEM. This is commonly used by adversaries
+  to spawn a process in an elevated state.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_schtasks`
-  Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_schtasks_create_run_as_system_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+  as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create
+  *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives will be limited to legitimate applications
+  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
+  the query to have world writeable paths to restrict it.
 references:
-  - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
-  - https://www.ired.team/offensive-security/persistence/t1053-schtask
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
+- https://www.ired.team/offensive-security/persistence/t1053-schtask
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Windows Persistence Techniques
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1053.005
-  - T1053
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 60
-  # (impact * confidence)/100
-  risk_score: 48
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An $process_name$ was created on endpoint $dest$ attempting to spawn as
+    SYSTEM.
+  mitre_attack_id:
+  - T1053.005
+  - T1053
   observable:
   - name: dest
     type: Hostname
@@ -66,4 +52,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 48
+  security_domain: endpoint
diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index e87ce92d78..d0260a789b 100644
--- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -6,47 +6,59 @@ author: Xiao Lin, Splunk
 type: Anomaly
 datamodel:
 - Network_Traffic
-description: Insider might conduct information collection before data exfiltration, and unusual volume of data
-  download from internal server is an indicator of such potential threat. This detection evaluates the total 
-  bytes downloaded from internal servers at specific time window per entity level, and then flagged these that 
-  are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte 
-  volume is unusual even though that operation is benigh, which causes false positive. It is therefore advised 
-  to adjust threshold and time window based on detection performance whenever necessary. It should be noted that 
-  seasonality is not modeled in the current approach.
-search: '| from read_ssa_enriched_events() 
-  | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
-  | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | where sourcetype == "pan:traffic"
-  | eval src_device_scope = map_get(input_event, "src_device_scope")
-  | eval dest_device_scope = map_get(input_event, "src_device_scope")
-  | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL
-  | eval dest_device = map_get(input_event, "dest_device_ips")
-  | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
-  | eval src_device = map_get(input_event, "source_device_ips")
-  | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
-  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", null))
-  | where download_bytes IS NOT NULL
-  | eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id")
-  | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L
-  | eval end_time = timestamp
-  | eval start_time = end_time - 86400
-  | eval body = create_map(["event_id", event_id, "tenant", tenant])
-  | select start_time, end_time, dest_device, label, body
-  | into write_ssa_detected_events();'
-how_to_implement: Ingest PAN traffic logs 
-known_false_positives: Benign large volume data download might be flagged as (false) positive.
+description: Insider might conduct information collection before data exfiltration,
+  and unusual volume of data download from internal server is an indicator of such
+  potential threat. This detection evaluates the total bytes downloaded from internal
+  servers at specific time window per entity level, and then flagged these that are
+  higher than 99.999% percentile as an anamaly. A behavior will be reported as long
+  as the downloaded byte volume is unusual even though that operation is benigh, which
+  causes false positive. It is therefore advised to adjust threshold and time window
+  based on detection performance whenever necessary. It should be noted that seasonality
+  is not modeled in the current approach.
+search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
+  "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
+  = map_get(input_event, "src_device_scope") | eval dest_device_scope = map_get(input_event,
+  "src_device_scope") | where src_device_scope IS NOT NULL AND dest_device_scope IS
+  NOT NULL | eval dest_device = map_get(input_event, "dest_device_ips") | where dest_device
+  IS NOT NULL AND dest_device_scope == "INTERNAL" | eval src_device = map_get(input_event,
+  "source_device_ips") | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
+  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string",
+  null)) | where download_bytes IS NOT NULL | eval tenant = map_get(input_event, "_tenant"),
+  event_id = map_get(input_event, "event_id") | adaptive_threshold algorithm="quantile"
+  value="download_bytes" entity="dest_device" threshold=0.001 window=86400L | eval
+  end_time = timestamp | eval start_time = end_time - 86400 | eval body = create_map(["event_id",
+  event_id, "tenant", tenant]) | select start_time, end_time, dest_device, label,
+  body | into write_ssa_detected_events();'
+how_to_implement: Ingest PAN traffic logs
+known_false_positives: Benign large volume data download might be flagged as (false)
+  positive.
 references:
 - https://github.com/twitter/AnomalyDetection
 tags:
   analytic_story:
   - Insider Threat
+  cis20:
+  - CIS 13
+  confidence: 50
+  context: null
   dataset:
   - https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
+  impact: 50
   kill_chain_phases:
   - Weaponization
+  message: $src_device_ip downloaded unusually amount of data from internal server
+    within one day
   mitre_attack_id:
   - T1213
   - T1039
+  nist:
+  - DE.AE
+  observable:
+  - name: src_device_ip
+    type: Host IP
+    role:
+    - Others
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -54,19 +66,6 @@ tags:
   - dest_device_scope
   - bytes_in
   - src_device_ips
-  security_domain: network
-  impact: 50
-  confidence: 50
   risk_score: 25
   risk_severity: low
-  context:
-  message: $src_device_ip downloaded unusually amount of data from internal server within one day
-  observable:
-    - name: src_device_ip
-      type: Host IP
-      role:
-      - Others
-  nist:
-  - DE.AE
-  cis20:
-  - CIS 13
+  security_domain: network
diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index 77badffaea..f920f70d44 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.34.3"
+      "version": "3.35.0"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 4797263b7c..0dcfbf8f44 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:30 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -625,7 +625,7 @@ references = ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injectio
 maintainers = [{"company": "no", "email": "-", "name": "Jose Hernandez"}]
 spec_version = 3
 searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"]
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Respond', 'Log4j Splunk Investigation' 
 narrative = In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called ["A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.
 
 [analytic_story://Malicious PowerShell]
@@ -1192,7 +1192,7 @@ version = 1
 references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"]
+searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"]
 description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.
 narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code.
 
@@ -1286,7 +1286,7 @@ version = 2
 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Verclsid CLSID Execution - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Verclsid CLSID Execution - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Remote Assistance Spawning Process - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\
@@ -1332,7 +1332,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -1370,7 +1370,7 @@ version = 2
 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
 
@@ -3662,7 +3662,8 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
@@ -7607,10 +7608,10 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+explanation = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
-known_false_positives = While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process
+known_false_positives = False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
 providing_technologies = []
 
 [savedsearch://ESCU - Runas Execution in CommandLine - Rule]
@@ -9399,6 +9400,36 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = False positives should be limited, however filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Rasautou DLL Execution - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"]}
+known_false_positives = False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Remote Assistance Spawning Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
+known_false_positives = False positives should be limited, filter as needed. Add additional shells as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Schtasks Create Run As System - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
+known_false_positives = False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Security Account Manager Stopped - Rule]
 type = detection
 asset_type = Endpoint
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 7dfa3fcb68..36304c7868 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 5113
+build = 5376
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.34.3
+version = 3.35.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index bb7a1bff0b..c66818a536 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:30 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 907ca68e8e..35fcb9a892 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.34.3
+version = 3.35.0
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 3760d30279..a0582ff2da 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -337,7 +337,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
 [panel_group://workbench_panel_group_log4shell_cve_2021_44228]
 label = Log4Shell CVE-2021-44228
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Respond', 'Log4j Splunk Investigation' 
 disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index ca2355c816..1973581e1b 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:30 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4071,6 +4071,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_rasautou_dll_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_remote_assistance_spawning_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_schtasks_create_run_as_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_security_account_manager_stopped_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index c1d6f25968..3ffe4532d0 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:29 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -2953,8 +2953,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
-action.escu.creation_date = 2021-03-23
-action.escu.modification_date = 2021-03-23
+action.escu.creation_date = 2022-02-03
+action.escu.modification_date = 2022-02-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split Arguments - Rule
 action.escu.search_type = detection
@@ -2988,7 +2988,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`
 
 [ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule]
 action.escu = 0
@@ -2999,8 +2999,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. 
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
-action.escu.creation_date = 2021-03-23
-action.escu.modification_date = 2021-03-23
+action.escu.creation_date = 2022-02-03
+action.escu.modification_date = 2022-02-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule
 action.escu.search_type = detection
@@ -3034,7 +3034,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl* Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`
 
 [ESCU - CertUtil With Decode Argument - Rule]
 action.escu = 0
@@ -9542,14 +9542,16 @@ search = | tstats `security_content_summariesonly` count values(Web.url) as url
 [ESCU - Detection of DNS Tunnels - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 action.escu.how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
 action.escu.known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
-action.escu.creation_date = 2017-09-18
-action.escu.modification_date = 2017-09-18
+action.escu.creation_date = 2022-02-15
+action.escu.modification_date = 2022-02-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detection of DNS Tunnels - Rule
 action.escu.search_type = detection
@@ -9565,7 +9567,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "S
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['src']
-action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 action.notable.param.rule_title = Detection of DNS Tunnels
 action.notable.param.security_domain = network
 action.notable.param.severity = high
@@ -15653,7 +15656,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject Ds Group with PowerShell - Rule]
 action.escu = 0
@@ -15744,7 +15747,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject User Account with PowerShell - Rule]
 action.escu = 0
@@ -20330,7 +20333,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|||]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter`
 
 [ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule]
 action.escu = 0
@@ -23898,7 +23901,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|||]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `powershell___connect_to_internet_with_hidden_window_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `powershell___connect_to_internet_with_hidden_window_filter`
 
 [ESCU - PowerShell 4104 Hunting - Rule]
 action.escu = 0
@@ -26984,35 +26987,35 @@ search = | tstats `security_content_summariesonly` count  FROM datamodel=Endpoin
 [ESCU - RunDLL Loading DLL By Ordinal - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+description = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+action.escu.eli5 = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-action.escu.known_false_positives = While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process
-action.escu.creation_date = 2020-11-30
-action.escu.modification_date = 2020-11-30
+action.escu.known_false_positives = False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+action.escu.creation_date = 2022-02-08
+action.escu.modification_date = 2022-02-08
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - RunDLL Loading DLL By Ordinal - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Unusual Processes"]
+action.escu.analytic_story = ["Unusual Processes", "Suspicious Rundll32 Activity"]
 action.risk = 1
-action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
+action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Deprecated - RunDLL Loading DLL By Ordinal - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]}
+action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['user', 'dest']
-action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+action.notable.param.rule_description = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 action.notable.param.rule_title = RunDLL Loading DLL By Ordinal
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -27025,7 +27028,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`
 
 [ESCU - Runas Execution in CommandLine - Rule]
 action.escu = 0
@@ -34906,6 +34909,144 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`
 
+[ESCU - Windows Rasautou DLL Execution - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+action.escu.creation_date = 2022-02-15
+action.escu.modification_date = 2022-02-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rasautou DLL Execution - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rasautou DLL Execution - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+action.notable.param.rule_title = Windows Rasautou DLL Execution
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`
+
+[ESCU - Windows Remote Assistance Spawning Process - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives should be limited, filter as needed. Add additional shells as needed.
+action.escu.creation_date = 2022-02-07
+action.escu.modification_date = 2022-02-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Assistance Spawning Process - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Unusual Processes"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Assistance Spawning Process - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+action.notable.param.rule_title = Windows Remote Assistance Spawning Process
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`
+
+[ESCU - Windows Schtasks Create Run As System - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+action.escu.creation_date = 2022-02-07
+action.escu.modification_date = 2022-02-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Schtasks Create Run As System - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Windows Persistence Techniques"]
+action.risk = 1
+action.risk.param._risk_message = An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Schtasks Create Run As System - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+action.notable.param.rule_title = Windows Schtasks Create Run As System
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`
+
 [ESCU - Windows Security Account Manager Stopped - Rule]
 action.escu = 0
 action.escu.enabled = 1
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 8221c34b7c..a89212e058 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:29 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index 8f641c57c3..2ad587f434 100644
--- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -1,6 +1,6 @@
 author: Jose Hernandez, David Dorsey, Michael Haag Splunk
 datamodel:
-- Endpoint
+- Endpoint_Processes
 date: '2022-02-11'
 description: The following hunting analytic identifies PowerShell commands utilizing
   the WindowStyle parameter to hide the window on the compromised endpoint. This combination
diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
index 1799870fc0..88e821cb25 100644
--- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
@@ -1,6 +1,6 @@
 author: Jose Hernandez, Michael Haag, Splunk
 datamodel:
-- Endpoint
+- Endpoint_Processes
 date: '2022-02-11'
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadFile` method. This particular method is utilized in many different
diff --git a/docs/_pages/adversary_tactics.md b/docs/_pages/adversary_tactics.md
index 6a9d33dae5..72d14631ec 100644
--- a/docs/_pages/adversary_tactics.md
+++ b/docs/_pages/adversary_tactics.md
@@ -26,18 +26,18 @@ sidebar:
 | [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
 | [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [HAFNIUM Group](/stories/hafnium_group/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
-| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
+| [HAFNIUM Group](/stories/hafnium_group/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Linux Persistence Techniques](/stories/linux_persistence_techniques/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Linux Privilege Escalation](/stories/linux_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Malicious PowerShell](/stories/malicious_powershell/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [ProxyShell](/stories/proxyshell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
 | [SQL Injection](/stories/sql_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
@@ -58,8 +58,8 @@ sidebar:
 | [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
\ No newline at end of file
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index cb94713d5c..3ae678ceae 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -61,8 +61,8 @@ sidebar:
 | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
@@ -218,7 +218,7 @@ sidebar:
 | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP |
 | [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Disable Defender AntiVirus Registry](/experimental/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender BlockAtFirstSeen Feature](/endpoint/disable_defender_blockatfirstseen_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender Enhanced Notification](/endpoint/disable_defender_enhanced_notification/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender MpEngine Registry](/endpoint/disable_defender_mpengine_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
@@ -357,8 +357,8 @@ sidebar:
 | [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly |
 | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing) | Hunting |
 | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly |
@@ -574,6 +574,7 @@ sidebar:
 | [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP |
 | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP |
+| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft) | Hunting |
 | [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting |
 | [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
@@ -687,6 +688,7 @@ sidebar:
 | [Unusual LOLBAS in short period of time](/endpoint/unusual_lolbas_in_short_period_of_time/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Unusual Number of Computer Service Tickets Requested](/endpoint/unusual_number_of_computer_service_tickets_requested/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
 | [Unusual Number of Remote Endpoint Authentication Events](/endpoint/unusual_number_of_remote_endpoint_authentication_events/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
+| [Unusual Volume of Data Download from Internal Server Per Entity](/network/unusual_volume_of_data_download_from_internal_server_per_entity/) | [Data from Information Repositories](/tags/#data-from-information-repositories), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | Anomaly |
 | [Unusually Long Command Line]() | None | Anomaly |
 | [Unusually Long Command Line - MLTK]() | None | Anomaly |
 | [Unusually Long Content-Type Length]() | None | Anomaly |
@@ -737,7 +739,12 @@ sidebar:
 | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | Hunting |
 | [Windows Non-System Account Targeting Lsass](/endpoint/windows_non-system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP |
+| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Windows Service Created With Suspicious Service Path](/endpoint/windows_service_created_with_suspicious_service_path/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP |
 | [Windows Service Created Within Public Path](/endpoint/windows_service_created_within_public_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index 6cb21c61dd..d9725d5fc1 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -49,18 +49,18 @@ sidebar:
 | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [HAFNIUM Group](hafnium_group) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [HAFNIUM Group](hafnium_group) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
 | [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Information Sabotage](information_sabotage) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Impact](/tags/#impact) |
-| [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
+| [Ingress Tool Transfer](ingress_tool_transfer) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
 | [Linux Persistence Techniques](linux_persistence_techniques) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Linux Privilege Escalation](linux_privilege_escalation) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Malicious PowerShell](malicious_powershell) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
@@ -70,7 +70,7 @@ sidebar:
 | [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | [Collection](/tags/#collection) |
 | [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
 | [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
@@ -112,11 +112,11 @@ sidebar:
 | [Use of Cleartext Protocols]() | None | None |
 | [WhisperGate](whispergate) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
 | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md
index a8e87a9108..85c316de0a 100644
--- a/docs/_playbooks/delete_detected_files.md
+++ b/docs/_playbooks/delete_detected_files.md
@@ -768,6 +768,13 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_playbooks/log4j_investigate.md b/docs/_playbooks/log4j_investigate.md
index 78edf26f80..6b2213464f 100644
--- a/docs/_playbooks/log4j_investigate.md
+++ b/docs/_playbooks/log4j_investigate.md
@@ -1464,6 +1464,15 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
+
+
 
 
 
@@ -1903,6 +1912,11 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
 
 
 
@@ -3372,6 +3386,20 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -4252,6 +4280,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -4927,6 +4962,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -5679,6 +5721,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6176,6 +6225,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6775,6 +6831,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_playbooks/log4j_respond.md b/docs/_playbooks/log4j_respond.md
index f8c67f79b8..a5da0306dc 100644
--- a/docs/_playbooks/log4j_respond.md
+++ b/docs/_playbooks/log4j_respond.md
@@ -1464,6 +1464,15 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
+
+
 
 
 
@@ -1903,6 +1912,11 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
 
 
 
@@ -3372,6 +3386,20 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -4252,6 +4280,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -4927,6 +4962,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -5679,6 +5721,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6176,6 +6225,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6775,6 +6831,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md
index fa7b2d2847..47801c8dcc 100644
--- a/docs/_playbooks/ransomware_investigate_and_contain.md
+++ b/docs/_playbooks/ransomware_investigate_and_contain.md
@@ -773,6 +773,13 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
index 0e6aa72098..2f63b5c62b 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
@@ -43,7 +43,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 #### Search
 
 ```
-`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) 
+`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_group*") 
 | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
 | `security_content_ctime(firstTime)` 
 | `getwmiobject_ds_group_with_powershell_script_block_filter`
diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
index 4aa3b5b543..fe86ffa34a 100644
--- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -39,7 +39,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 #### Search
 
 ```
-`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) 
+`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_computer*") 
 | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
 | `security_content_ctime(firstTime)` 
 | `getwmiobject_ds_computer_with_powershell_script_block_filter`
diff --git a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
index 3b4c5cea0f..3511f37a66 100644
--- a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
@@ -2,7 +2,7 @@
 title: "Disable Defender AntiVirus Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
-  - Experimental
+  - Endpoint
 last_modified_at: 2021-12-08
 toc: true
 toc_label: ""
@@ -107,4 +107,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/experimental/disable_defender_antivirus_registry.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/disable_defender_antivirus_registry.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md b/docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md
new file mode 100644
index 0000000000..144f0b10b8
--- /dev/null
+++ b/docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md
@@ -0,0 +1,122 @@
+---
+title: "Unusual Volume of Data Download from Internal Server Per Entity"
+excerpt: "Data from Information Repositories, Data from Network Shared Drive"
+categories:
+  - Network
+last_modified_at: 2022-01-17
+toc: true
+toc_label: ""
+tags:
+  - Data from Information Repositories
+  - Collection
+  - Data from Network Shared Drive
+  - Collection
+  - Splunk Behavioral Analytics
+  - Network_Traffic
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Insider might conduct information collection before data exfiltration, and unusual volume of data download from internal server is an indicator of such potential threat. This detection evaluates the total bytes downloaded from internal servers at specific time window per entity level, and then flagged these that are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte volume is unusual even though that operation is benigh, which causes false positive. It is therefore advised to adjust threshold and time window based on detection performance whenever necessary. It should be noted that seasonality is not modeled in the current approach.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Last Updated**: 2022-01-17
+- **Author**: Xiao Lin, Splunk
+- **ID**: cca028f4-77dd-11ec-bc09-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1213](https://attack.mitre.org/techniques/T1213/) | Data from Information Repositories | Collection |
+
+| [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null) 
+| eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
+| where sourcetype == "pan:traffic" 
+| eval src_device_scope = map_get(input_event, "src_device_scope") 
+| eval dest_device_scope = map_get(input_event, "src_device_scope") 
+| where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL 
+| eval dest_device = map_get(input_event, "dest_device_ips") 
+| where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL" 
+| eval src_device = map_get(input_event, "source_device_ips") 
+| where src_device IS NOT NULL AND src_device_scope == "INTERNAL" 
+| eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", null)) 
+| where download_bytes IS NOT NULL 
+| eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id") 
+| adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L 
+| eval end_time = timestamp 
+| eval start_time = end_time - 86400 
+| eval body = create_map(["event_id", event_id, "tenant", tenant]) 
+| select start_time, end_time, dest_device, label, body 
+| into write_ssa_detected_events();
+```
+
+#### Macros
+The SPL above uses the following Macros:
+
+Note that `unusual_volume_of_data_download_from_internal_server_per_entity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest_device_scope
+* bytes_in
+* src_device_ips
+
+
+#### How To Implement
+Ingest PAN traffic logs
+
+#### Known False Positives
+Benign large volume data download might be flagged as (false) positive.
+
+#### Associated Analytic story
+* [Insider Threat](/stories/insider_threat)
+
+
+#### Kill Chain Phase
+* Weaponization
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | $src_device_ip downloaded unusually amount of data from internal server within one day |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://github.com/twitter/AnomalyDetection](https://github.com/twitter/AnomalyDetection)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt](https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/unusual_volume_of_data_download_from_internal_server_per_entity.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
similarity index 92%
rename from docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
rename to docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index 156161fa1b..0bf192b760 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -3,7 +3,7 @@ title: "CertUtil Download With URLCache and Split Arguments"
 excerpt: "Ingress Tool Transfer"
 categories:
   - Endpoint
-last_modified_at: 2021-03-23
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -26,7 +26,7 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-23
+- **Last Updated**: 2022-02-03
 - **Author**: Michael Haag, Splunk
 - **ID**: 415b4306-8bfb-11eb-85c4-acde48001122
 
@@ -41,7 +41,7 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
@@ -114,4 +114,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
similarity index 93%
rename from docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
rename to docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index fb296b4edf..b28f780ff3 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -3,7 +3,7 @@ title: "CertUtil Download With VerifyCtl and Split Arguments"
 excerpt: "Ingress Tool Transfer"
 categories:
   - Endpoint
-last_modified_at: 2021-03-23
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -26,7 +26,7 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-23
+- **Last Updated**: 2022-02-03
 - **Author**: Michael Haag, Splunk
 - **ID**: 801ad9e4-8bfb-11eb-8b31-acde48001122
 
@@ -41,7 +41,7 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl* Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
@@ -115,4 +115,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
new file mode 100644
index 0000000000..c822b0c567
--- /dev/null
+++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
@@ -0,0 +1,115 @@
+---
+title: "Windows Remote Assistance Spawning Process"
+excerpt: "Process Injection"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-07
+toc: true
+toc_label: ""
+tags:
+  - Process Injection
+  - Defense Evasion
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-07
+- **Author**: Michael Haag, Splunk
+- **ID**: ced50492-8849-11ec-9f68-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_assistance_spawning_process_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
+
+Note that `windows_remote_assistance_spawning_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives should be limited, filter as needed. Add additional shells as needed.
+
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
new file mode 100644
index 0000000000..9cbc4303c2
--- /dev/null
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -0,0 +1,124 @@
+---
+title: "Windows Schtasks Create Run As System"
+excerpt: "Scheduled Task, Scheduled Task/Job"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-07
+toc: true
+toc_label: ""
+tags:
+  - Scheduled Task
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Scheduled Task/Job
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-07
+- **Author**: Michael Haag, Splunk
+- **ID**: 41a0e58e-884c-11ec-9976-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_schtasks_create_run_as_system_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `windows_schtasks_create_run_as_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 48.0 | 80 | 60 | An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/](https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/)
+* [https://www.ired.team/offensive-security/persistence/t1053-schtask](https://www.ired.team/offensive-security/persistence/t1053-schtask)
+* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
new file mode 100644
index 0000000000..4bbca30820
--- /dev/null
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -0,0 +1,120 @@
+---
+title: "RunDLL Loading DLL By Ordinal"
+excerpt: "Signed Binary Proxy Execution, Rundll32"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-08
+toc: true
+toc_label: ""
+tags:
+  - Signed Binary Proxy Execution
+  - Defense Evasion
+  - Rundll32
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-08
+- **Author**: Michael Haag, David Dorsey, Splunk
+- **ID**: 6c135f8d-5e60-454e-80b7-c56eed739833
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| where match(process,"rundll32.+\#\d+") 
+| `rundll_loading_dll_by_ordinal_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `rundll_loading_dll_by_ordinal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+
+
+#### Kill Chain Phase
+* Installation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml) \| *version*: **6**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md
new file mode 100644
index 0000000000..8c77f3b277
--- /dev/null
+++ b/docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md
@@ -0,0 +1,118 @@
+---
+title: "Windows Powershell Connect to Internet With Hidden Window"
+excerpt: "Automated Exfiltration"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-11
+toc: true
+toc_label: ""
+tags:
+  - Automated Exfiltration
+  - Exfiltration
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2022-02-11
+- **Author**: Jose Hernandez, David Dorsey, Michael Haag Splunk
+- **ID**: 477e068e-8b6d-11ec-b6c1-81af21670352
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
+| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe" 
+| where match_regex(cmd_line, /(?i)[\\-
+|\\/
+|\u2013\
+|\u2014
+|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Macros
+The SPL above uses the following Macros:
+
+Note that `windows_powershell_connect_to_internet_with_hidden_window_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### How To Implement
+You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the &#34;process&#34; field in the Endpoint data model.
+
+#### Known False Positives
+Legitimate process can have this combination of command-line options, but it&#39;s not common.
+
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [HAFNIUM Group](/stories/hafnium_group)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
+#### Kill Chain Phase
+* Exfiltration
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 35.0 | 50 | 70 | PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://regexr.com/663rr](https://regexr.com/663rr)
+* [https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1](https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1)
+* [https://ss64.com/ps/powershell.html](https://ss64.com/ps/powershell.html)
+* [https://twitter.com/M_haggis/status/1440758396534214658?s=20](https://twitter.com/M_haggis/status/1440758396534214658?s=20)
+* [https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/](https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_powershell_connect_to_internet_with_hidden_window.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-11-windows_powershell_downloadfile.md b/docs/_posts/2022-02-11-windows_powershell_downloadfile.md
new file mode 100644
index 0000000000..0a911cad32
--- /dev/null
+++ b/docs/_posts/2022-02-11-windows_powershell_downloadfile.md
@@ -0,0 +1,111 @@
+---
+title: "Windows Powershell DownloadFile"
+excerpt: "Automated Exfiltration"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-11
+toc: true
+toc_label: ""
+tags:
+  - Automated Exfiltration
+  - Exfiltration
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2022-02-11
+- **Author**: Jose Hernandez, Michael Haag, Splunk
+- **ID**: 46440222-81d5-44b1-a376-19dcd70d1b08
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
+| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe" 
+| where (like (cmd_line, "%downloadfile%")) 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Macros
+The SPL above uses the following Macros:
+
+Note that `windows_powershell_downloadfile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
+
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
+#### Kill Chain Phase
+* Lateral Movement
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0)
+* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_powershell_downloadfile.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
new file mode 100644
index 0000000000..689c9f9ca5
--- /dev/null
+++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
@@ -0,0 +1,126 @@
+---
+title: "Windows Rasautou DLL Execution"
+excerpt: "Dynamic-link Library Injection, Signed Binary Proxy Execution, Process Injection"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-15
+toc: true
+toc_label: ""
+tags:
+  - Dynamic-link Library Injection
+  - Defense Evasion
+  - Privilege Escalation
+  - Signed Binary Proxy Execution
+  - Defense Evasion
+  - Process Injection
+  - Defense Evasion
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-15
+- **Author**: Michael Haag, Splunk
+- **ID**: 6f42b8be-8e96-11ec-ad5a-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1055.001](https://attack.mitre.org/techniques/T1055/001/) | Dynamic-link Library Injection | Defense Evasion, Privilege Escalation |
+
+| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_rasautou_dll_execution_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `windows_rasautou_dll_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://github.com/mandiant/DueDLLigence](https://github.com/mandiant/DueDLLigence)
+* [https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1](https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1)
+* [https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513](https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513)
+* [https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html](https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_rasautou_dll_execution.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md
index a3f454b5e4..99b0828fa0 100644
--- a/docs/_stories/credential_dumping.md
+++ b/docs/_stories/credential_dumping.md
@@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
diff --git a/docs/_stories/hafnium_group.md b/docs/_stories/hafnium_group.md
index 270972af69..1e6493d72b 100644
--- a/docs/_stories/hafnium_group.md
+++ b/docs/_stories/hafnium_group.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Traffic
 ---
 
@@ -18,7 +19,7 @@ tags:
 HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
 - **Last Updated**: 2021-03-03
 - **Author**: Michael Haag, Splunk
 - **ID**: beae2ab0-7c3f-11eb-8b63-acde48001122
@@ -48,6 +49,7 @@ The following Splunk detections assist with identifying the HAFNIUM groups trade
 | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
 | [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/ingress_tool_transfer.md b/docs/_stories/ingress_tool_transfer.md
index 078b9ab0ae..37cf9a276d 100644
--- a/docs/_stories/ingress_tool_transfer.md
+++ b/docs/_stories/ingress_tool_transfer.md
@@ -42,6 +42,7 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors
 | [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/log4shell_cve-2021-44228.md b/docs/_stories/log4shell_cve-2021-44228.md
index 37c3708b5e..35970c7731 100644
--- a/docs/_stories/log4shell_cve-2021-44228.md
+++ b/docs/_stories/log4shell_cve-2021-44228.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Traffic
   - Web
 ---
@@ -19,7 +20,7 @@ tags:
 Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
 - **Last Updated**: 2021-12-11
 - **Author**: Jose Hernandez
 - **ID**: b4453928-5a98-11ec-afcd-8de10b48fc52
@@ -45,6 +46,8 @@ In late November 2021, Chen Zhaojun of Alibaba identified a remote code executio
 | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting |
 | [Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Java Spawning Shells](/endpoint/windows_java_spawning_shells/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md
index eacb96c613..45f7ce457d 100644
--- a/docs/_stories/malicious_powershell.md
+++ b/docs/_stories/malicious_powershell.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -17,7 +18,7 @@ tags:
 Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
 - **Last Updated**: 2017-08-23
 - **Author**: David Dorsey, Splunk
 - **ID**: 2c8ff66e-0b57-42af-8ad7-912438a403fc
@@ -64,6 +65,8 @@ Most recently we have added new content related to PowerShell Script Block loggi
 | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md
index b79362f204..b8ad6c1ccd 100644
--- a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md
+++ b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -17,7 +18,7 @@ tags:
 Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
 - **Last Updated**: 2020-01-22
 - **Author**: iDefense Cyber Espionage Team, iDefense
 - **ID**: 988C59C5-0A1C-45B6-A555-0C62276E327E
@@ -61,6 +62,7 @@ If behavioral searches included in this story yield positive hits, iDefense reco
 | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) |  | Anomaly |
 | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) |  | Anomaly |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/suspicious_rundll32_activity.md b/docs/_stories/suspicious_rundll32_activity.md
index fd9bebf848..4e756c283c 100644
--- a/docs/_stories/suspicious_rundll32_activity.md
+++ b/docs/_stories/suspicious_rundll32_activity.md
@@ -34,6 +34,7 @@ One common adversary tactic is to bypass application control solutions via the r
 | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting |
 | [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
diff --git a/docs/_stories/unusual_processes.md b/docs/_stories/unusual_processes.md
index 4dd5c0cb17..0628ca5535 100644
--- a/docs/_stories/unusual_processes.md
+++ b/docs/_stories/unusual_processes.md
@@ -38,6 +38,7 @@ In the event an unusual process is identified, it is imperative to better unders
 | [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | TTP |
 | [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly |
 | [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly |
+| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | TTP |
 | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP |
 | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP |
@@ -49,6 +50,7 @@ In the event an unusual process is identified, it is imperative to better unders
 | [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP |
 | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP |
 | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | TTP |
+| [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | TTP |
 | [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | TTP |
 
 #### Reference
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index 001a481dac..077d5a4ef8 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -51,8 +51,8 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Powershell Windows Defender Exclusion Commands](/endpoint/powershell_windows_defender_exclusion_commands/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
@@ -66,6 +66,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | TTP |
 
 #### Reference
 
diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md
index 6643cec58e..2a309c5ec7 100644
--- a/docs/_stories/windows_persistence_techniques.md
+++ b/docs/_stories/windows_persistence_techniques.md
@@ -36,8 +36,8 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
 | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
@@ -56,6 +56,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting |
+| [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 
 #### Reference
 
diff --git a/docs/index.markdown b/docs/index.markdown
index db6b78b036..e1bb85bc5a 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -9,12 +9,12 @@ header:
   actions:
     - label: "Download"
       url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **749** detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **756** detections for Splunk."
 feature_row:
   - image_path: /static/feature_detection.png
     alt: "customizable"
     title: "Detections"
-    excerpt: "See all **749** Splunk Analytics built to find evil 😈."
+    excerpt: "See all **756** Splunk Analytics built to find evil 😈."
     url: "/detections"
     btn_class: "btn--primary"
     btn_label: "Explore"
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index 64281d6e19..04c865189d 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -86,44 +86,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -156,31 +155,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -216,9 +216,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -275,27 +277,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -519,8 +523,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -585,18 +589,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -1463,57 +1468,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -1530,52 +1536,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -1650,7 +1655,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -1906,44 +1912,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -1976,31 +1981,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -2036,9 +2042,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -2095,27 +2103,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -2339,8 +2349,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -2405,18 +2415,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -3283,57 +3294,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -3350,52 +3362,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -3470,7 +3481,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -3726,44 +3738,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -3796,31 +3807,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -3856,9 +3868,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -3915,27 +3929,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -4159,8 +4175,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -4225,18 +4241,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -5103,57 +5120,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -5170,52 +5188,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -5290,7 +5307,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -5546,44 +5564,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -5616,31 +5633,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -5676,9 +5694,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -5735,27 +5755,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -5979,8 +6001,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -6045,18 +6067,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -6923,57 +6946,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -6990,52 +7014,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -7110,7 +7133,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -7366,44 +7390,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -7436,31 +7459,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -7496,9 +7520,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -7555,27 +7581,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -7799,8 +7827,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -7865,18 +7893,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -8743,57 +8772,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -8810,52 +8840,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -8930,7 +8959,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -9186,44 +9216,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -9256,31 +9285,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -9316,9 +9346,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -9375,27 +9407,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -9619,8 +9653,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -9685,18 +9719,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -10563,57 +10598,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -10630,52 +10666,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -10750,7 +10785,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -11006,44 +11042,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -11076,31 +11111,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -11136,9 +11172,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -11195,27 +11233,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -11439,8 +11479,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -11505,18 +11545,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -12383,57 +12424,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -12450,52 +12492,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -12570,7 +12611,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -12826,44 +12868,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -12896,31 +12937,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -12956,9 +12998,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -13015,27 +13059,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -13259,8 +13305,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -13325,18 +13371,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -14203,57 +14250,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -14270,52 +14318,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -14390,7 +14437,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -14646,44 +14694,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -14716,31 +14763,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -14776,9 +14824,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -14835,27 +14885,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -15079,8 +15131,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -15145,18 +15197,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -16023,57 +16076,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -16090,52 +16144,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -16210,7 +16263,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -16466,44 +16520,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -16536,31 +16589,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -16596,9 +16650,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -16655,27 +16711,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -16899,8 +16957,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -16965,18 +17023,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -17843,57 +17902,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -17910,52 +17970,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -18030,7 +18089,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -18286,44 +18346,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -18356,31 +18415,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -18416,9 +18476,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -18475,27 +18537,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -18719,8 +18783,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -18785,18 +18849,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -19663,57 +19728,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -19730,52 +19796,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -19850,7 +19915,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -20106,44 +20172,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -20176,31 +20241,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -20236,9 +20302,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -20295,27 +20363,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -20539,8 +20609,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -20605,18 +20675,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -21483,57 +21554,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -21550,52 +21622,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -21670,7 +21741,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -21926,44 +21998,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -21996,31 +22067,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -22056,9 +22128,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -22115,27 +22189,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -22359,8 +22435,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -22425,18 +22501,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -23303,57 +23380,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -23370,52 +23448,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -23490,7 +23567,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -23746,44 +23824,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -23816,31 +23893,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -23876,9 +23954,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -23935,27 +24015,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -24179,8 +24261,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -24245,18 +24327,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -25123,57 +25206,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -25190,52 +25274,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -25310,7 +25393,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -25566,44 +25650,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -25636,31 +25719,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -25696,9 +25780,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -25755,27 +25841,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -25999,8 +26087,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -26065,18 +26153,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -26943,57 +27032,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -27010,52 +27100,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -27130,7 +27219,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -27386,44 +27476,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -27456,31 +27545,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -27516,9 +27606,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -27575,27 +27667,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -27819,8 +27913,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -27885,18 +27979,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -28763,57 +28858,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -28830,52 +28926,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -28950,7 +29045,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -29206,44 +29302,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -29276,31 +29371,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -29336,9 +29432,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -29395,27 +29493,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -29639,8 +29739,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -29705,18 +29805,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -30583,57 +30684,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -30650,52 +30752,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -30770,7 +30871,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -31026,44 +31128,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -31096,31 +31197,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -31156,9 +31258,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -31215,27 +31319,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -31459,8 +31565,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -31525,18 +31631,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -32403,57 +32510,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -32470,52 +32578,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -32590,7 +32697,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -32846,44 +32954,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -32916,31 +33023,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -32976,9 +33084,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -33035,27 +33145,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -33279,8 +33391,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -33345,18 +33457,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -34223,57 +34336,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -34290,52 +34404,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -34410,7 +34523,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -34666,44 +34780,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -34736,31 +34849,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -34796,9 +34910,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -34855,27 +34971,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -35099,8 +35217,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -35165,18 +35283,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -36043,57 +36162,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -36110,52 +36230,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -36230,7 +36349,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -36486,44 +36606,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -36556,31 +36675,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -36616,9 +36736,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -36675,27 +36797,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -36919,8 +37043,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -36985,18 +37109,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -37863,57 +37988,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -37930,52 +38056,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -38050,7 +38175,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -38306,44 +38432,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -38376,31 +38501,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -38436,9 +38562,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -38495,27 +38623,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -38739,8 +38869,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -38805,18 +38935,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -39683,57 +39814,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -39750,52 +39882,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -39870,7 +40001,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -40126,44 +40258,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -40196,31 +40327,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -40256,9 +40388,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -40315,27 +40449,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -40559,8 +40695,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -40625,18 +40761,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -41503,57 +41640,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -41570,52 +41708,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -41690,7 +41827,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -41946,44 +42084,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -42016,31 +42153,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -42076,9 +42214,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -42135,27 +42275,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -42379,8 +42521,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -42445,18 +42587,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -43323,57 +43466,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -43390,52 +43534,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -43510,7 +43653,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -43766,44 +43910,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -43836,31 +43979,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -43896,9 +44040,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -43955,27 +44101,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -44199,8 +44347,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -44265,18 +44413,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -45143,57 +45292,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -45210,52 +45360,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -45330,7 +45479,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -45586,44 +45736,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -45656,31 +45805,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -45716,9 +45866,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -45775,27 +45927,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -46019,8 +46173,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -46085,18 +46239,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -46963,57 +47118,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -47030,52 +47186,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -47150,7 +47305,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -47406,44 +47562,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -47476,31 +47631,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -47536,9 +47692,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -47595,27 +47753,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -47839,8 +47999,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -47905,18 +48065,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -48783,57 +48944,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -48850,52 +49012,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -48970,7 +49131,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -49226,44 +49388,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -49296,31 +49457,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -49356,9 +49518,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -49415,27 +49579,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -49659,8 +49825,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -49725,18 +49891,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -50603,57 +50770,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -50670,52 +50838,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -50790,7 +50957,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -51046,44 +51214,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -51116,31 +51283,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -51176,9 +51344,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -51235,27 +51405,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -51479,8 +51651,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -51545,18 +51717,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -52423,57 +52596,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -52490,52 +52664,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -52610,7 +52783,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -52866,44 +53040,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -52936,31 +53109,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -52996,9 +53170,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -53055,27 +53231,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -53299,8 +53477,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -53365,18 +53543,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -54243,57 +54422,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -54310,52 +54490,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -54430,7 +54609,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -54686,44 +54866,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -54756,31 +54935,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -54816,9 +54996,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -54875,27 +55057,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -55119,8 +55303,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -55185,18 +55369,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -56063,57 +56248,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -56130,52 +56316,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -56250,7 +56435,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -56506,44 +56692,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -56576,31 +56761,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -56636,9 +56822,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -56695,27 +56883,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -56939,8 +57129,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -57005,18 +57195,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -57883,57 +58074,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -57950,52 +58142,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -58070,7 +58261,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -58326,44 +58518,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -58396,31 +58587,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -58456,9 +58648,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -58515,27 +58709,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -58759,8 +58955,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -58825,18 +59021,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -59703,57 +59900,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -59770,52 +59968,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -59890,7 +60087,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -60146,44 +60344,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -60216,31 +60413,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -60276,9 +60474,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -60335,27 +60535,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -60579,8 +60781,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -60645,18 +60847,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -61523,57 +61726,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -61590,52 +61794,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -61710,7 +61913,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -61966,44 +62170,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -62036,31 +62239,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -62096,9 +62300,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -62155,27 +62361,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -62399,8 +62607,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -62465,18 +62673,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -63343,57 +63552,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -63410,52 +63620,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -63530,7 +63739,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -63786,44 +63996,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -63856,31 +64065,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -63916,9 +64126,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -63975,27 +64187,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -64219,8 +64433,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -64285,18 +64499,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -65163,57 +65378,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -65230,52 +65446,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -65350,7 +65565,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -65606,44 +65822,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -65676,31 +65891,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -65736,9 +65952,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -65795,27 +66013,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -66039,8 +66259,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -66105,18 +66325,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -66983,57 +67204,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -67050,52 +67272,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -67170,7 +67391,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -67426,44 +67648,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -67496,31 +67717,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -67556,9 +67778,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -67615,27 +67839,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -67859,8 +68085,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -67925,18 +68151,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -68803,57 +69030,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -68870,52 +69098,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -68990,7 +69217,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -69246,44 +69474,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -69316,31 +69543,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -69376,9 +69604,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -69435,27 +69665,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -69679,8 +69911,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -69745,18 +69977,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -70623,57 +70856,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -70690,52 +70924,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -70810,7 +71043,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -71066,44 +71300,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -71136,31 +71369,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -71196,9 +71430,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -71255,27 +71491,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -71499,8 +71737,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -71565,18 +71803,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -72443,57 +72682,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -72510,52 +72750,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -72630,7 +72869,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -72886,44 +73126,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -72956,31 +73195,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -73016,9 +73256,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -73075,27 +73317,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -73319,8 +73563,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -73385,18 +73629,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -74263,57 +74508,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -74330,52 +74576,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -74450,7 +74695,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -74706,44 +74952,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -74776,31 +75021,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -74836,9 +75082,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -74895,27 +75143,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -75139,8 +75389,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -75205,18 +75455,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -76083,57 +76334,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -76150,52 +76402,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -76270,7 +76521,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -76526,44 +76778,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -76596,31 +76847,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -76656,9 +76908,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -76715,27 +76969,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -76959,8 +77215,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -77025,18 +77281,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -77903,57 +78160,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -77970,52 +78228,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -78090,7 +78347,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -78346,44 +78604,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -78416,31 +78673,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -78476,9 +78734,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -78535,27 +78795,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -78779,8 +79041,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -78845,18 +79107,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -79723,57 +79986,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -79790,52 +80054,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -79910,7 +80173,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -80166,44 +80430,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -80236,31 +80499,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -80296,9 +80560,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -80355,27 +80621,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -80599,8 +80867,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -80665,18 +80933,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -81543,57 +81812,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -81610,52 +81880,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -81730,7 +81999,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -81986,44 +82256,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -82056,31 +82325,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -82116,9 +82386,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -82175,27 +82447,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -82419,8 +82693,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -82485,18 +82759,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -83363,57 +83638,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -83430,52 +83706,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -83550,7 +83825,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -83806,44 +84082,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -83876,31 +84151,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -83936,9 +84212,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -83995,27 +84273,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -84239,8 +84519,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -84305,18 +84585,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -85183,57 +85464,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -85250,52 +85532,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -85370,7 +85651,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -85626,44 +85908,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -85696,31 +85977,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -85756,9 +86038,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -85815,27 +86099,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -86059,8 +86345,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -86125,18 +86411,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -87003,57 +87290,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -87070,52 +87358,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -87190,7 +87477,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -87446,44 +87734,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -87516,31 +87803,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -87576,9 +87864,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -87635,27 +87925,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -87879,8 +88171,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -87945,18 +88237,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -88823,57 +89116,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -88890,52 +89184,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -89010,7 +89303,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -89266,44 +89560,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -89336,31 +89629,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -89396,9 +89690,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -89455,27 +89751,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -89699,8 +89997,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -89765,18 +90063,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -90643,57 +90942,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -90710,52 +91010,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -90830,7 +91129,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -91086,44 +91386,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -91156,31 +91455,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -91216,9 +91516,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -91275,27 +91577,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -91519,8 +91823,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -91585,18 +91889,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -92463,57 +92768,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -92530,52 +92836,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -92650,7 +92955,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -92906,44 +93212,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -92976,31 +93281,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -93036,9 +93342,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -93095,27 +93403,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -93339,8 +93649,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -93405,18 +93715,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -94283,57 +94594,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -94350,52 +94662,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -94470,7 +94781,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -94726,44 +95038,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -94796,31 +95107,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -94856,9 +95168,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -94915,27 +95229,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -95159,8 +95475,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -95225,18 +95541,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -96103,57 +96420,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -96170,52 +96488,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -96290,7 +96607,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -96546,44 +96864,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -96616,31 +96933,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -96676,9 +96994,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -96735,27 +97055,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -96979,8 +97301,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -97045,18 +97367,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -97923,57 +98246,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -97990,52 +98314,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -98110,7 +98433,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -98366,44 +98690,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -98436,31 +98759,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -98496,9 +98820,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -98555,27 +98881,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -98799,8 +99127,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -98865,18 +99193,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -99743,57 +100072,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -99810,52 +100140,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -99930,7 +100259,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -100186,44 +100516,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -100256,31 +100585,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -100316,9 +100646,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -100375,27 +100707,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -100619,8 +100953,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -100685,18 +101019,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -101563,57 +101898,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -101630,52 +101966,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -101750,7 +102085,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -102006,44 +102342,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -102076,31 +102411,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -102136,9 +102472,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -102195,27 +102533,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -102439,8 +102779,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -102505,18 +102845,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -103383,57 +103724,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -103450,52 +103792,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -103570,7 +103911,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -103826,44 +104168,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -103896,31 +104237,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -103956,9 +104298,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -104015,27 +104359,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -104259,8 +104605,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -104325,18 +104671,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -105203,57 +105550,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -105270,52 +105618,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -105390,7 +105737,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -105646,44 +105994,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -105716,31 +106063,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -105776,9 +106124,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -105835,27 +106185,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -106079,8 +106431,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -106145,18 +106497,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -107023,57 +107376,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -107090,52 +107444,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -107210,7 +107563,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -107466,44 +107820,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -107536,31 +107889,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -107596,9 +107950,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -107655,27 +108011,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -107899,8 +108257,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -107965,18 +108323,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -108843,57 +109202,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -108910,52 +109270,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -109030,7 +109389,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -109286,44 +109646,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -109356,31 +109715,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -109416,9 +109776,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -109475,27 +109837,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -109719,8 +110083,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -109785,18 +110149,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -110663,57 +111028,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -110730,52 +111096,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -110850,7 +111215,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -111106,44 +111472,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -111176,31 +111541,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -111236,9 +111602,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -111295,27 +111663,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -111539,8 +111909,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -111605,18 +111975,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -112483,57 +112854,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -112550,52 +112922,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -112670,7 +113041,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -112926,44 +113298,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -112996,31 +113367,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -113056,9 +113428,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -113115,27 +113489,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -113359,8 +113735,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -113425,18 +113801,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -114303,57 +114680,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -114370,52 +114748,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -114490,7 +114867,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -114746,44 +115124,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -114816,31 +115193,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -114876,9 +115254,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -114935,27 +115315,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -115179,8 +115561,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -115245,18 +115627,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -116123,57 +116506,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -116190,52 +116574,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -116310,7 +116693,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -116566,44 +116950,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -116636,31 +117019,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -116696,9 +117080,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -116755,27 +117141,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -116999,8 +117387,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -117065,18 +117453,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -117943,57 +118332,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -118010,52 +118400,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -118130,7 +118519,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -118386,44 +118776,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -118456,31 +118845,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -118516,9 +118906,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -118575,27 +118967,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -118819,8 +119213,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -118885,18 +119279,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -119763,57 +120158,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -119830,52 +120226,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -119950,7 +120345,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -120206,44 +120602,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -120276,31 +120671,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -120336,9 +120732,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -120395,27 +120793,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -120639,8 +121039,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -120705,18 +121105,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -121583,57 +121984,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -121650,52 +122052,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -121770,7 +122171,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -122026,44 +122428,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -122096,31 +122497,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -122156,9 +122558,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -122215,27 +122619,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -122459,8 +122865,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -122525,18 +122931,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -123403,57 +123810,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -123470,52 +123878,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -123590,7 +123997,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -123846,44 +124254,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -123916,31 +124323,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -123976,9 +124384,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -124035,27 +124445,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -124279,8 +124691,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -124345,18 +124757,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -125223,57 +125636,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -125290,52 +125704,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -125410,7 +125823,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -125666,44 +126080,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -125736,31 +126149,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -125796,9 +126210,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -125855,27 +126271,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -126099,8 +126517,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -126165,18 +126583,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -127043,57 +127462,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -127110,52 +127530,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -127230,7 +127649,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -127486,44 +127906,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -127556,31 +127975,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -127616,9 +128036,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -127675,27 +128097,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -127919,8 +128343,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -127985,18 +128409,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -128863,57 +129288,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -128930,52 +129356,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -129050,7 +129475,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -129306,44 +129732,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -129376,31 +129801,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -129436,9 +129862,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -129495,27 +129923,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -129739,8 +130169,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -129805,18 +130235,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -130683,57 +131114,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -130750,52 +131182,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -130870,7 +131301,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -131126,44 +131558,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -131196,31 +131627,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -131256,9 +131688,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -131315,27 +131749,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -131559,8 +131995,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -131625,18 +132061,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -132503,57 +132940,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -132570,52 +133008,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -132690,7 +133127,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -132946,44 +133384,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -133016,31 +133453,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -133076,9 +133514,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -133135,27 +133575,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -133379,8 +133821,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -133445,18 +133887,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -134323,57 +134766,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -134390,52 +134834,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -134510,7 +134953,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -134766,44 +135210,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -134836,31 +135279,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -134896,9 +135340,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -134955,27 +135401,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -135199,8 +135647,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -135265,18 +135713,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -136143,57 +136592,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -136210,52 +136660,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -136330,7 +136779,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -136586,44 +137036,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -136656,31 +137105,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -136716,9 +137166,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -136775,27 +137227,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -137019,8 +137473,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -137085,18 +137539,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -137963,57 +138418,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -138030,52 +138486,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -138150,7 +138605,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -138406,44 +138862,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -138476,31 +138931,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -138536,9 +138992,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -138595,27 +139053,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -138839,8 +139299,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -138905,18 +139365,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -139783,57 +140244,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -139850,52 +140312,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -139970,7 +140431,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -140226,44 +140688,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -140296,31 +140757,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -140356,9 +140818,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -140415,27 +140879,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -140659,8 +141125,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -140725,18 +141191,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -141603,57 +142070,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -141670,52 +142138,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -141790,7 +142257,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -142046,44 +142514,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -142116,31 +142583,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -142176,9 +142644,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -142235,27 +142705,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -142479,8 +142951,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -142545,18 +143017,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -143423,57 +143896,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -143490,52 +143964,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -143610,7 +144083,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -143866,44 +144340,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -143936,31 +144409,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -143996,9 +144470,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -144055,27 +144531,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -144299,8 +144777,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -144365,18 +144843,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -145243,57 +145722,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -145310,52 +145790,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -145430,7 +145909,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -145686,44 +146166,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -145756,31 +146235,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -145816,9 +146296,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -145875,27 +146357,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -146119,8 +146603,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -146185,18 +146669,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -147063,57 +147548,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -147130,52 +147616,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -147250,7 +147735,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -147506,44 +147992,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -147576,31 +148061,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -147636,9 +148122,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -147695,27 +148183,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -147939,8 +148429,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -148005,18 +148495,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -148883,57 +149374,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -148950,52 +149442,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -149070,7 +149561,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -149326,44 +149818,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -149396,31 +149887,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -149456,9 +149948,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -149515,27 +150009,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -149759,8 +150255,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -149825,18 +150321,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -150703,57 +151200,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -150770,52 +151268,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -150890,7 +151387,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -151146,44 +151644,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -151216,31 +151713,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -151276,9 +151774,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -151335,27 +151835,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -151579,8 +152081,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -151645,18 +152147,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -152523,57 +153026,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -152590,52 +153094,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -152710,7 +153213,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -152966,44 +153470,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -153036,31 +153539,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -153096,9 +153600,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -153155,27 +153661,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -153399,8 +153907,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -153465,18 +153973,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -154343,57 +154852,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -154410,52 +154920,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -154530,7 +155039,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -154786,44 +155296,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -154856,31 +155365,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -154916,9 +155426,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -154975,27 +155487,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -155219,8 +155733,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -155285,18 +155799,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -156163,57 +156678,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -156230,52 +156746,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -156350,7 +156865,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -156606,44 +157122,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -156676,31 +157191,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -156736,9 +157252,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -156795,27 +157313,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -157039,8 +157559,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -157105,18 +157625,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -157983,57 +158504,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -158050,52 +158572,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -158170,7 +158691,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -158426,44 +158948,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -158496,31 +159017,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -158556,9 +159078,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -158615,27 +159139,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -158859,8 +159385,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -158925,18 +159451,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -159803,57 +160330,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -159870,52 +160398,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -159990,7 +160517,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -160246,44 +160774,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -160316,31 +160843,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -160376,9 +160904,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -160435,27 +160965,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -160679,8 +161211,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -160745,18 +161277,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -161623,57 +162156,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -161690,52 +162224,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -161810,7 +162343,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -162066,44 +162600,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -162136,31 +162669,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -162196,9 +162730,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -162255,27 +162791,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -162499,8 +163037,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -162565,18 +163103,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -163443,57 +163982,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -163510,52 +164050,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -163630,7 +164169,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -163886,44 +164426,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -163956,31 +164495,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -164016,9 +164556,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -164075,27 +164617,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -164319,8 +164863,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -164385,18 +164929,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -165263,57 +165808,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -165330,52 +165876,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -165450,7 +165995,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -165706,44 +166252,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -165776,31 +166321,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -165836,9 +166382,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -165895,27 +166443,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -166139,8 +166689,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -166205,18 +166755,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -167083,57 +167634,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -167150,52 +167702,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -167270,7 +167821,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -167526,44 +168078,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -167596,31 +168147,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -167656,9 +168208,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -167715,27 +168269,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -167959,8 +168515,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -168025,18 +168581,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -168903,57 +169460,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -168970,52 +169528,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -169090,7 +169647,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -169346,44 +169904,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -169416,31 +169973,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -169476,9 +170034,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -169535,27 +170095,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -169779,8 +170341,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -169845,18 +170407,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -170723,57 +171286,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -170790,52 +171354,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -170910,7 +171473,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -171166,44 +171730,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -171236,31 +171799,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -171296,9 +171860,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -171355,27 +171921,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -171599,8 +172167,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -171665,18 +172233,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -172543,57 +173112,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -172610,52 +173180,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -172730,7 +173299,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -172986,44 +173556,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -173056,31 +173625,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -173116,9 +173686,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -173175,27 +173747,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -173419,8 +173993,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -173485,18 +174059,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -174363,57 +174938,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -174430,52 +175006,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -174550,7 +175125,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -174806,44 +175382,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -174876,31 +175451,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -174936,9 +175512,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -174995,27 +175573,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -175239,8 +175819,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -175305,18 +175885,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -176183,57 +176764,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -176250,52 +176832,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -176370,7 +176951,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -176626,44 +177208,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -176696,31 +177277,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -176756,9 +177338,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -176815,27 +177399,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -177059,8 +177645,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -177125,18 +177711,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -178003,57 +178590,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -178070,52 +178658,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -178190,7 +178777,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -178446,44 +179034,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -178516,31 +179103,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -178576,9 +179164,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -178635,27 +179225,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -178879,8 +179471,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -178945,18 +179537,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -179823,57 +180416,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -179890,52 +180484,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -180010,7 +180603,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -180266,44 +180860,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -180336,31 +180929,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -180396,9 +180990,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -180455,27 +181051,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -180699,8 +181297,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -180765,18 +181363,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -181643,57 +182242,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -181710,52 +182310,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -181830,7 +182429,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -182086,44 +182686,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -182156,31 +182755,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -182216,9 +182816,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -182275,27 +182877,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -182519,8 +183123,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -182585,18 +183189,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -183463,57 +184068,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -183530,52 +184136,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -183650,7 +184255,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -183906,44 +184512,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -183976,31 +184581,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -184036,9 +184642,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -184095,27 +184703,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -184339,8 +184949,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -184405,18 +185015,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -185283,57 +185894,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -185350,52 +185962,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -185470,7 +186081,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -185726,44 +186338,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -185796,31 +186407,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -185856,9 +186468,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -185915,27 +186529,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -186159,8 +186775,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -186225,18 +186841,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -187103,57 +187720,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -187170,52 +187788,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -187290,7 +187907,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -187546,44 +188164,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -187616,31 +188233,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -187676,9 +188294,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -187735,27 +188355,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -187979,8 +188601,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -188045,18 +188667,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -188923,57 +189546,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -188990,52 +189614,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -189110,7 +189733,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -189366,44 +189990,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -189436,31 +190059,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -189496,9 +190120,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -189555,27 +190181,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -189799,8 +190427,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -189865,18 +190493,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -190743,57 +191372,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -190810,52 +191440,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -190930,7 +191559,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -191186,44 +191816,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -191256,31 +191885,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -191316,9 +191946,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -191375,27 +192007,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -191619,8 +192253,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -191685,18 +192319,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -192563,57 +193198,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -192630,52 +193266,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -192750,7 +193385,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -193006,44 +193642,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -193076,31 +193711,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -193136,9 +193772,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -193195,27 +193833,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -193439,8 +194079,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -193505,18 +194145,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -194383,57 +195024,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -194450,52 +195092,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -194570,7 +195211,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -194826,44 +195468,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -194896,31 +195537,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -194956,9 +195598,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -195015,27 +195659,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -195259,8 +195905,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -195325,18 +195971,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -196203,57 +196850,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -196270,52 +196918,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -196390,7 +197037,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -196646,44 +197294,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -196716,31 +197363,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -196776,9 +197424,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -196835,27 +197485,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -197079,8 +197731,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -197145,18 +197797,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -198023,57 +198676,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -198090,52 +198744,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -198210,7 +198863,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -198466,44 +199120,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -198536,31 +199189,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -198596,9 +199250,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -198655,27 +199311,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -198899,8 +199557,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -198965,18 +199623,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -199843,57 +200502,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -199910,52 +200570,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -200030,7 +200689,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -200286,44 +200946,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -200356,31 +201015,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -200416,9 +201076,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -200475,27 +201137,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -200719,8 +201383,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -200785,18 +201449,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -201663,57 +202328,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -201730,52 +202396,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -201850,7 +202515,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -202106,44 +202772,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -202176,31 +202841,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -202236,9 +202902,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -202295,27 +202963,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -202539,8 +203209,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -202605,18 +203275,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -203483,57 +204154,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -203550,52 +204222,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -203670,7 +204341,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -203926,44 +204598,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -203996,31 +204667,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -204056,9 +204728,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -204115,27 +204789,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -204359,8 +205035,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -204425,18 +205101,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -205303,57 +205980,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -205370,52 +206048,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -205490,7 +206167,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -205746,44 +206424,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -205816,31 +206493,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -205876,9 +206554,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -205935,27 +206615,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -206179,8 +206861,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -206245,18 +206927,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -207123,57 +207806,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -207190,52 +207874,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -207310,7 +207993,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -207566,44 +208250,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -207636,31 +208319,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -207696,9 +208380,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -207755,27 +208441,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -207999,8 +208687,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -208065,18 +208753,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -208943,57 +209632,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -209010,52 +209700,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -209130,7 +209819,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -209386,44 +210076,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -209456,31 +210145,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -209516,9 +210206,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -209575,27 +210267,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -209819,8 +210513,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -209885,18 +210579,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -210763,57 +211458,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -210830,52 +211526,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -210950,7 +211645,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -211206,44 +211902,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -211276,31 +211971,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -211336,9 +212032,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -211395,27 +212093,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -211639,8 +212339,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -211705,18 +212405,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -212583,57 +213284,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -212650,52 +213352,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -212770,7 +213471,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -213026,44 +213728,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -213096,31 +213797,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -213156,9 +213858,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -213215,27 +213919,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -213459,8 +214165,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -213525,18 +214231,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -214403,57 +215110,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -214470,52 +215178,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -214590,7 +215297,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -214846,44 +215554,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -214916,31 +215623,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -214976,9 +215684,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -215035,27 +215745,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -215279,8 +215991,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -215345,18 +216057,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -216223,57 +216936,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -216290,52 +217004,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -216410,7 +217123,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -216666,44 +217380,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -216736,31 +217449,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -216796,9 +217510,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -216855,27 +217571,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -217099,8 +217817,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -217165,18 +217883,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -218043,57 +218762,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -218110,52 +218830,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -218230,7 +218949,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -218486,44 +219206,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -218556,31 +219275,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -218616,9 +219336,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -218675,27 +219397,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -218919,8 +219643,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -218985,18 +219709,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -219863,57 +220588,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -219930,52 +220656,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -220050,7 +220775,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -220306,44 +221032,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -220376,31 +221101,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -220436,9 +221162,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -220495,27 +221223,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -220739,8 +221469,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -220805,18 +221535,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -221683,57 +222414,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -221750,52 +222482,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -221870,7 +222601,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -222126,44 +222858,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -222196,31 +222927,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -222256,9 +222988,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -222315,27 +223049,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -222559,8 +223295,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -222625,18 +223361,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -223503,57 +224240,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -223570,52 +224308,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -223690,7 +224427,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -223946,44 +224684,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -224016,31 +224753,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -224076,9 +224814,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -224135,27 +224875,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -224379,8 +225121,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -224445,18 +225187,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -225323,57 +226066,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -225390,52 +226134,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -225510,7 +226253,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -225766,44 +226510,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -225836,31 +226579,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -225896,9 +226640,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -225955,27 +226701,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -226199,8 +226947,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -226265,18 +227013,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -227143,57 +227892,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -227210,52 +227960,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -227330,7 +228079,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -227586,44 +228336,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -227656,31 +228405,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -227716,9 +228466,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -227775,27 +228527,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -228019,8 +228773,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -228085,18 +228839,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -228963,57 +229718,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -229030,52 +229786,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -229150,7 +229905,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -229406,44 +230162,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -229476,31 +230231,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -229536,9 +230292,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -229595,27 +230353,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -229839,8 +230599,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -229905,18 +230665,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -230783,57 +231544,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -230850,52 +231612,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -230970,7 +231731,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -231226,44 +231988,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -231296,31 +232057,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -231356,9 +232118,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -231415,27 +232179,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -231659,8 +232425,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -231725,18 +232491,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -232603,57 +233370,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -232670,52 +233438,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -232790,7 +233557,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -233046,44 +233814,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -233116,31 +233883,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -233176,9 +233944,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -233235,27 +234005,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -233479,8 +234251,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -233545,18 +234317,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -234423,57 +235196,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -234490,52 +235264,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -234610,7 +235383,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -234866,44 +235640,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -234936,31 +235709,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -234996,9 +235770,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -235055,27 +235831,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -235299,8 +236077,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -235365,18 +236143,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -236243,57 +237022,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -236310,52 +237090,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -236430,7 +237209,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -236686,44 +237466,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -236756,31 +237535,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -236816,9 +237596,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -236875,27 +237657,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -237119,8 +237903,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -237185,18 +237969,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -238063,57 +238848,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -238130,52 +238916,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -238250,7 +239035,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -238506,44 +239292,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -238576,31 +239361,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -238636,9 +239422,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -238695,27 +239483,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -238939,8 +239729,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -239005,18 +239795,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -239883,57 +240674,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -239950,52 +240742,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -240070,7 +240861,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -240326,44 +241118,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -240396,31 +241187,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -240456,9 +241248,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -240515,27 +241309,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -240759,8 +241555,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -240825,18 +241621,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -241703,57 +242500,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -241770,52 +242568,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -241890,7 +242687,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -242146,44 +242944,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -242216,31 +243013,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -242276,9 +243074,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -242335,27 +243135,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -242579,8 +243381,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -242645,18 +243447,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -243523,57 +244326,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -243590,52 +244394,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -243710,7 +244513,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -243966,44 +244770,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -244036,31 +244839,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -244096,9 +244900,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -244155,27 +244961,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -244399,8 +245207,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -244465,18 +245273,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -245343,57 +246152,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -245410,52 +246220,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -245530,7 +246339,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -245786,44 +246596,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -245856,31 +246665,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -245916,9 +246726,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -245975,27 +246787,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -246219,8 +247033,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -246285,18 +247099,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -247163,57 +247978,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -247230,52 +248046,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -247350,7 +248165,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -247606,44 +248422,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -247676,31 +248491,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -247736,9 +248552,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -247795,27 +248613,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -248039,8 +248859,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -248105,18 +248925,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -248983,57 +249804,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -249050,52 +249872,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -249170,7 +249991,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -249426,44 +250248,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -249496,31 +250317,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -249556,9 +250378,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -249615,27 +250439,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -249859,8 +250685,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -249925,18 +250751,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -250803,57 +251630,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -250870,52 +251698,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -250990,7 +251817,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -251246,44 +252074,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -251316,31 +252143,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -251376,9 +252204,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -251435,27 +252265,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -251679,8 +252511,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -251745,18 +252577,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -252623,57 +253456,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -252690,52 +253524,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -252810,7 +253643,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -253066,44 +253900,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -253136,31 +253969,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -253196,9 +254030,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -253255,27 +254091,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -253499,8 +254337,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -253565,18 +254403,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -254443,57 +255282,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -254510,52 +255350,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -254630,7 +255469,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -254886,44 +255726,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -254956,31 +255795,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -255016,9 +255856,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -255075,27 +255917,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -255319,8 +256163,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -255385,18 +256229,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -256263,57 +257108,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -256330,52 +257176,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -256450,7 +257295,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -256706,44 +257552,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -256776,31 +257621,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -256836,9 +257682,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -256895,27 +257743,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -257139,8 +257989,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -257205,18 +258055,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -258083,57 +258934,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -258150,52 +259002,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -258270,7 +259121,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -258526,44 +259378,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -258596,31 +259447,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -258656,9 +259508,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -258715,27 +259569,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -258959,8 +259815,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -259025,18 +259881,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -259903,57 +260760,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -259970,52 +260828,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -260090,7 +260947,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -260346,44 +261204,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -260416,31 +261273,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -260476,9 +261334,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -260535,27 +261395,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -260779,8 +261641,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -260845,18 +261707,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -261723,57 +262586,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -261790,52 +262654,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -261910,7 +262773,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -262166,44 +263030,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -262236,31 +263099,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -262296,9 +263160,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -262355,27 +263221,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -262599,8 +263467,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -262665,18 +263533,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -263543,57 +264412,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -263610,52 +264480,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -263730,7 +264599,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -263986,44 +264856,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -264056,31 +264925,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -264116,9 +264986,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -264175,27 +265047,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -264419,8 +265293,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -264485,18 +265359,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -265363,57 +266238,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -265430,52 +266306,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -265550,7 +266425,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -265806,44 +266682,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -265876,31 +266751,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -265936,9 +266812,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -265995,27 +266873,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -266239,8 +267119,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -266305,18 +267185,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -267183,57 +268064,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -267250,52 +268132,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -267370,7 +268251,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -267626,44 +268508,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -267696,31 +268577,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -267756,9 +268638,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -267815,27 +268699,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -268059,8 +268945,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -268125,18 +269011,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -269003,57 +269890,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -269070,52 +269958,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -269190,7 +270077,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -269446,44 +270334,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -269516,31 +270403,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -269576,9 +270464,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -269635,27 +270525,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -269879,8 +270771,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -269945,18 +270837,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -270823,57 +271716,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -270890,52 +271784,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -271010,7 +271903,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -271266,44 +272160,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -271336,31 +272229,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -271396,9 +272290,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -271455,27 +272351,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -271699,8 +272597,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -271765,18 +272663,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -272643,57 +273542,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -272710,52 +273610,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -272830,7 +273729,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -273086,44 +273986,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -273156,31 +274055,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -273216,9 +274116,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -273275,27 +274177,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -273519,8 +274423,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -273585,18 +274489,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -274463,57 +275368,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -274530,52 +275436,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -274650,7 +275555,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -274906,44 +275812,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -274976,31 +275881,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -275036,9 +275942,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -275095,27 +276003,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -275339,8 +276249,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -275405,18 +276315,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -276283,57 +277194,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -276350,52 +277262,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -276470,7 +277381,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -276726,44 +277638,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -276796,31 +277707,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -276856,9 +277768,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -276915,27 +277829,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -277159,8 +278075,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -277225,18 +278141,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -278103,57 +279020,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -278170,52 +279088,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -278290,7 +279207,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -278546,44 +279464,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -278616,31 +279533,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -278676,9 +279594,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -278735,27 +279655,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -278979,8 +279901,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -279045,18 +279967,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -279923,57 +280846,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -279990,52 +280914,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -280110,7 +281033,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -280366,44 +281290,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -280436,31 +281359,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -280496,9 +281420,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -280555,27 +281481,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -280799,8 +281727,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -280865,18 +281793,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -281743,57 +282672,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -281810,52 +282740,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -281930,7 +282859,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -282186,44 +283116,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -282256,31 +283185,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -282316,9 +283246,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -282375,27 +283307,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -282619,8 +283553,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -282685,18 +283619,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -283563,57 +284498,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -283630,52 +284566,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -283750,7 +284685,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -284006,44 +284942,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -284076,31 +285011,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -284136,9 +285072,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -284195,27 +285133,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -284439,8 +285379,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -284505,18 +285445,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -285383,57 +286324,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -285450,52 +286392,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -285570,7 +286511,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -285826,44 +286768,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -285896,31 +286837,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -285956,9 +286898,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -286015,27 +286959,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -286259,8 +287205,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -286325,18 +287271,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -287203,57 +288150,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -287270,52 +288218,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -287390,7 +288337,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -287646,44 +288594,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -287716,31 +288663,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -287776,9 +288724,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -287835,27 +288785,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -288079,8 +289031,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -288145,18 +289097,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -289023,57 +289976,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -289090,52 +290044,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -289210,7 +290163,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -289466,44 +290420,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -289536,31 +290489,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -289596,9 +290550,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -289655,27 +290611,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -289899,8 +290857,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -289965,18 +290923,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -290843,57 +291802,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -290910,52 +291870,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -291030,7 +291989,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -291286,44 +292246,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -291356,31 +292315,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -291416,9 +292376,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -291475,27 +292437,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -291719,8 +292683,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -291785,18 +292749,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -292663,57 +293628,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -292730,52 +293696,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -292850,7 +293815,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -293106,44 +294072,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -293176,31 +294141,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -293236,9 +294202,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -293295,27 +294263,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -293539,8 +294509,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -293605,18 +294575,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -294483,57 +295454,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -294550,52 +295522,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -294670,7 +295641,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -294926,44 +295898,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -294996,31 +295967,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -295056,9 +296028,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -295115,27 +296089,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -295359,8 +296335,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -295425,18 +296401,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -296303,57 +297280,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -296370,52 +297348,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -296490,7 +297467,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -296746,44 +297724,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -296816,31 +297793,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -296876,9 +297854,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -296935,27 +297915,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -297179,8 +298161,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -297245,18 +298227,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -298123,57 +299106,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -298190,52 +299174,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -298310,7 +299293,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -298566,44 +299550,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -298636,31 +299619,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -298696,9 +299680,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -298755,27 +299741,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -298999,8 +299987,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -299065,18 +300053,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -299943,57 +300932,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -300010,52 +301000,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -300130,7 +301119,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -300386,44 +301376,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -300456,31 +301445,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -300516,9 +301506,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -300575,27 +301567,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -300819,8 +301813,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -300885,18 +301879,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -301763,57 +302758,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -301830,52 +302826,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -301950,7 +302945,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -302206,44 +303202,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -302276,31 +303271,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -302336,9 +303332,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -302395,27 +303393,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -302639,8 +303639,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -302705,18 +303705,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -303583,57 +304584,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -303650,52 +304652,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -303770,7 +304771,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -304026,44 +305028,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -304096,31 +305097,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -304156,9 +305158,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -304215,27 +305219,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -304459,8 +305465,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -304525,18 +305531,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -305403,57 +306410,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -305470,52 +306478,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -305590,7 +306597,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -305846,44 +306854,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -305916,31 +306923,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -305976,9 +306984,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -306035,27 +307045,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -306279,8 +307291,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -306345,18 +307357,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -307223,57 +308236,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -307290,52 +308304,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -307410,7 +308423,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -307666,44 +308680,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -307736,31 +308749,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -307796,9 +308810,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -307855,27 +308871,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -308099,8 +309117,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -308165,18 +309183,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -309043,57 +310062,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -309110,52 +310130,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -309230,7 +310249,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -309486,44 +310506,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -309556,31 +310575,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -309616,9 +310636,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -309675,27 +310697,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -309919,8 +310943,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -309985,18 +311009,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -310863,57 +311888,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -310930,52 +311956,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -311050,7 +312075,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -311306,44 +312332,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -311376,31 +312401,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -311436,9 +312462,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -311495,27 +312523,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -311739,8 +312769,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -311805,18 +312835,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -312683,57 +313714,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -312750,52 +313782,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -312870,7 +313901,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -313126,44 +314158,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -313196,31 +314227,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -313256,9 +314288,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -313315,27 +314349,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -313559,8 +314595,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -313625,18 +314661,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -314503,57 +315540,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -314570,52 +315608,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -314690,7 +315727,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -314946,44 +315984,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -315016,31 +316053,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -315076,9 +316114,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -315135,27 +316175,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -315379,8 +316421,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -315445,18 +316487,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -316323,57 +317366,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -316390,52 +317434,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -316510,7 +317553,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -316766,44 +317810,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -316836,31 +317879,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -316896,9 +317940,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -316955,27 +318001,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -317199,8 +318247,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -317265,18 +318313,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -318143,57 +319192,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -318210,52 +319260,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -318330,7 +319379,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -318586,44 +319636,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -318656,31 +319705,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -318716,9 +319766,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -318775,27 +319827,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -319019,8 +320073,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -319085,18 +320139,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -319963,57 +321018,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -320030,52 +321086,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -320150,7 +321205,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -320406,44 +321462,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -320476,31 +321531,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -320536,9 +321592,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -320595,27 +321653,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -320839,8 +321899,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -320905,18 +321965,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -321783,57 +322844,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -321850,52 +322912,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -321970,7 +323031,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -322226,44 +323288,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -322296,31 +323357,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -322356,9 +323418,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -322415,27 +323479,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -322659,8 +323725,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -322725,18 +323791,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -323603,57 +324670,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -323670,52 +324738,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -323790,7 +324857,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -324046,44 +325114,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -324116,31 +325183,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -324176,9 +325244,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -324235,27 +325305,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -324479,8 +325551,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -324545,18 +325617,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -325423,57 +326496,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -325490,52 +326564,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -325610,7 +326683,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -325866,44 +326940,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -325936,31 +327009,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -325996,9 +327070,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -326055,27 +327131,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -326299,8 +327377,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -326365,18 +327443,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -327243,57 +328322,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -327310,52 +328390,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -327430,7 +328509,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -327686,44 +328766,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -327756,31 +328835,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -327816,9 +328896,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -327875,27 +328957,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -328119,8 +329203,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -328185,18 +329269,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -329063,57 +330148,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -329130,52 +330216,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -329250,7 +330335,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -329506,44 +330592,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -329576,31 +330661,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -329636,9 +330722,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -329695,27 +330783,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -329939,8 +331029,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -330005,18 +331095,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -330883,57 +331974,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -330950,52 +332042,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -331070,7 +332161,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -331326,44 +332418,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -331396,31 +332487,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -331456,9 +332548,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -331515,27 +332609,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -331759,8 +332855,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -331825,18 +332921,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -332703,57 +333800,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -332770,52 +333868,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -332890,7 +333987,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -333146,44 +334244,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -333216,31 +334313,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -333276,9 +334374,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -333335,27 +334435,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -333579,8 +334681,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -333645,18 +334747,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -334523,57 +335626,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -334590,52 +335694,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -334710,7 +335813,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -334966,44 +336070,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -335036,31 +336139,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -335096,9 +336200,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -335155,27 +336261,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -335399,8 +336507,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -335465,18 +336573,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -336343,57 +337452,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -336410,52 +337520,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -336530,7 +337639,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -336786,44 +337896,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -336856,31 +337965,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -336916,9 +338026,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -336975,27 +338087,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -337219,8 +338333,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -337285,18 +338399,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -338163,57 +339278,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -338230,52 +339346,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -338350,7 +339465,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -338606,44 +339722,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -338676,31 +339791,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -338736,9 +339852,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -338795,27 +339913,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -339039,8 +340159,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -339105,18 +340225,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -339983,57 +341104,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -340050,52 +341172,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -340170,7 +341291,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -340426,44 +341548,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -340496,31 +341617,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -340556,9 +341678,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -340615,27 +341739,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -340859,8 +341985,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -340925,18 +342051,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -341803,57 +342930,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -341870,52 +342998,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -341990,7 +343117,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -342246,44 +343374,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -342316,31 +343443,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -342376,9 +343504,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -342435,27 +343565,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -342679,8 +343811,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -342745,18 +343877,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -343623,57 +344756,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -343690,52 +344824,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -343810,7 +344943,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -344066,44 +345200,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -344136,31 +345269,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -344196,9 +345330,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -344255,27 +345391,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -344499,8 +345637,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -344565,18 +345703,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -345443,57 +346582,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -345510,52 +346650,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -345630,7 +346769,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -345886,44 +347026,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -345956,31 +347095,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -346016,9 +347156,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -346075,27 +347217,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -346319,8 +347463,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -346385,18 +347529,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -347263,57 +348408,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -347330,52 +348476,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -347450,7 +348595,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -347706,44 +348852,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -347776,31 +348921,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -347836,9 +348982,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -347895,27 +349043,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -348139,8 +349289,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -348205,18 +349355,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -349083,57 +350234,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -349150,52 +350302,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -349270,7 +350421,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -349526,44 +350678,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -349596,31 +350747,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -349656,9 +350808,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -349715,27 +350869,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -349959,8 +351115,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -350025,18 +351181,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -350903,57 +352060,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -350970,52 +352128,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -351090,7 +352247,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -351346,44 +352504,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -351416,31 +352573,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -351476,9 +352634,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -351535,27 +352695,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -351779,8 +352941,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -351845,18 +353007,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -352723,57 +353886,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -352790,52 +353954,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -352910,7 +354073,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -353166,44 +354330,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -353236,31 +354399,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -353296,9 +354460,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -353355,27 +354521,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -353599,8 +354767,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -353665,18 +354833,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -354543,57 +355712,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -354610,52 +355780,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -354730,7 +355899,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -354986,44 +356156,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -355056,31 +356225,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -355116,9 +356286,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -355175,27 +356347,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -355419,8 +356593,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -355485,18 +356659,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -356363,57 +357538,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -356430,52 +357606,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -356550,7 +357725,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -356806,44 +357982,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -356876,31 +358051,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -356936,9 +358112,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -356995,27 +358173,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -357239,8 +358419,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -357305,18 +358485,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -358183,57 +359364,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -358250,52 +359432,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -358370,7 +359551,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -358626,44 +359808,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -358696,31 +359877,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -358756,9 +359938,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -358815,27 +359999,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -359059,8 +360245,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -359125,18 +360311,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -360003,57 +361190,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -360070,52 +361258,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -360190,7 +361377,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -360446,44 +361634,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -360516,31 +361703,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -360576,9 +361764,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -360635,27 +361825,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -360879,8 +362071,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -360945,18 +362137,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -361823,57 +363016,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -361890,52 +363084,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -362010,7 +363203,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -362266,44 +363460,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -362336,31 +363529,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -362396,9 +363590,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -362455,27 +363651,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -362699,8 +363897,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -362765,18 +363963,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -363643,57 +364842,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -363710,52 +364910,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -363830,7 +365029,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -364086,44 +365286,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -364156,31 +365355,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -364216,9 +365416,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -364275,27 +365477,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -364519,8 +365723,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -364585,18 +365789,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -365463,57 +366668,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -365530,52 +366736,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -365650,7 +366855,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -365906,44 +367112,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -365976,31 +367181,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -366036,9 +367242,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -366095,27 +367303,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -366339,8 +367549,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -366405,18 +367615,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -367283,57 +368494,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -367350,52 +368562,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -367470,7 +368681,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -367726,44 +368938,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -367796,31 +369007,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -367856,9 +369068,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -367915,27 +369129,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -368159,8 +369375,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -368225,18 +369441,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -369103,57 +370320,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -369170,52 +370388,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -369290,7 +370507,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -369546,44 +370764,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -369616,31 +370833,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -369676,9 +370894,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -369735,27 +370955,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -369979,8 +371201,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -370045,18 +371267,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -370923,57 +372146,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -370990,52 +372214,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -371110,7 +372333,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -371366,44 +372590,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -371436,31 +372659,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -371496,9 +372720,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -371555,27 +372781,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -371799,8 +373027,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -371865,18 +373093,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -372743,57 +373972,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -372810,52 +374040,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -372930,7 +374159,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -373186,44 +374416,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -373256,31 +374485,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -373316,9 +374546,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -373375,27 +374607,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -373619,8 +374853,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -373685,18 +374919,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -374563,57 +375798,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -374630,52 +375866,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -374750,7 +375985,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -375006,44 +376242,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -375076,31 +376311,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -375136,9 +376372,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -375195,27 +376433,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -375439,8 +376679,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -375505,18 +376745,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -376383,57 +377624,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -376450,52 +377692,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -376570,7 +377811,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -376826,44 +378068,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -376896,31 +378137,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -376956,9 +378198,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -377015,27 +378259,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -377259,8 +378505,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -377325,18 +378571,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -378203,57 +379450,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -378270,52 +379518,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -378390,7 +379637,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -378646,44 +379894,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -378716,31 +379963,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -378776,9 +380024,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -378835,27 +380085,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -379079,8 +380331,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -379145,18 +380397,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -380023,57 +381276,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -380090,52 +381344,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -380210,7 +381463,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -380466,44 +381720,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -380536,31 +381789,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -380596,9 +381850,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -380655,27 +381911,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -380899,8 +382157,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -380965,18 +382223,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -381843,57 +383102,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -381910,52 +383170,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -382030,7 +383289,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -382286,44 +383546,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -382356,31 +383615,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -382416,9 +383676,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -382475,27 +383737,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -382719,8 +383983,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -382785,18 +384049,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -383663,57 +384928,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -383730,52 +384996,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -383850,7 +385115,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -384106,44 +385372,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -384176,31 +385441,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -384236,9 +385502,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -384295,27 +385563,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -384539,8 +385809,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -384605,18 +385875,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -385483,57 +386754,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -385550,52 +386822,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -385670,7 +386941,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -385926,44 +387198,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -385996,31 +387267,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -386056,9 +387328,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -386115,27 +387389,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -386359,8 +387635,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -386425,18 +387701,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -387303,57 +388580,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -387370,52 +388648,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -387490,7 +388767,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -387746,44 +389024,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -387816,31 +389093,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -387876,9 +389154,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -387935,27 +389215,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -388179,8 +389461,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -388245,18 +389527,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -389123,57 +390406,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -389190,52 +390474,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -389310,7 +390593,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -389566,44 +390850,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -389636,31 +390919,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -389696,9 +390980,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -389755,27 +391041,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -389999,8 +391287,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -390065,18 +391353,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -390943,57 +392232,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -391010,52 +392300,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -391130,7 +392419,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -391386,44 +392676,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -391456,31 +392745,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -391516,9 +392806,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -391575,27 +392867,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -391819,8 +393113,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -391885,18 +393179,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -392763,57 +394058,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -392830,52 +394126,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -392950,7 +394245,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -393206,44 +394502,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -393276,31 +394571,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -393336,9 +394632,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -393395,27 +394693,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -393639,8 +394939,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -393705,18 +395005,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -394583,57 +395884,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -394650,52 +395952,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -394770,7 +396071,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -395026,44 +396328,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -395096,31 +396397,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -395156,9 +396458,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -395215,27 +396519,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -395459,8 +396765,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -395525,18 +396831,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -396403,57 +397710,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -396470,52 +397778,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -396590,7 +397897,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -396846,44 +398154,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -396916,31 +398223,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -396976,9 +398284,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -397035,27 +398345,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -397279,8 +398591,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -397345,18 +398657,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -398223,57 +399536,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -398290,52 +399604,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -398410,7 +399723,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -398666,44 +399980,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -398736,31 +400049,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -398796,9 +400110,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -398855,27 +400171,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -399099,8 +400417,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -399165,18 +400483,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -400043,57 +401362,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -400110,52 +401430,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -400230,7 +401549,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -400486,44 +401806,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -400556,31 +401875,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -400616,9 +401936,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -400675,27 +401997,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -400919,8 +402243,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -400985,18 +402309,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -401863,57 +403188,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -401930,52 +403256,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -402050,7 +403375,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -402306,44 +403632,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -402376,31 +403701,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -402436,9 +403762,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -402495,27 +403823,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -402739,8 +404069,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -402805,18 +404135,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -403683,57 +405014,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -403750,52 +405082,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -403870,7 +405201,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -404126,44 +405458,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -404196,31 +405527,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -404256,9 +405588,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -404315,27 +405649,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -404559,8 +405895,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -404625,18 +405961,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -405503,57 +406840,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -405570,52 +406908,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -405690,7 +407027,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -405946,44 +407284,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -406016,31 +407353,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -406076,9 +407414,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -406135,27 +407475,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -406379,8 +407721,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -406445,18 +407787,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -407323,57 +408666,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -407390,52 +408734,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -407510,7 +408853,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -407766,44 +409110,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -407836,31 +409179,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -407896,9 +409240,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -407955,27 +409301,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -408199,8 +409547,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -408265,18 +409613,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -409143,57 +410492,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -409210,52 +410560,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -409330,7 +410679,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -409586,44 +410936,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -409656,31 +411005,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -409716,9 +411066,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -409775,27 +411127,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -410019,8 +411373,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -410085,18 +411439,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -410963,57 +412318,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -411030,52 +412386,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -411150,7 +412505,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -411406,44 +412762,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -411476,31 +412831,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -411536,9 +412892,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -411595,27 +412953,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -411839,8 +413199,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -411905,18 +413265,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -412783,57 +414144,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -412850,52 +414212,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -412970,7 +414331,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -413226,44 +414588,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -413296,31 +414657,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -413356,9 +414718,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -413415,27 +414779,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -413659,8 +415025,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -413725,18 +415091,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -414603,57 +415970,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -414670,52 +416038,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -414790,7 +416157,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -415046,44 +416414,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -415116,31 +416483,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -415176,9 +416544,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -415235,27 +416605,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -415479,8 +416851,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -415545,18 +416917,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -416423,57 +417796,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -416490,52 +417864,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -416610,7 +417983,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -416866,44 +418240,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -416936,31 +418309,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -416996,9 +418370,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -417055,27 +418431,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -417299,8 +418677,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -417365,18 +418743,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -418243,57 +419622,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -418310,52 +419690,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -418430,7 +419809,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -418686,44 +420066,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -418756,31 +420135,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -418816,9 +420196,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -418875,27 +420257,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -419119,8 +420503,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -419185,18 +420569,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -420063,57 +421448,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -420130,52 +421516,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -420250,7 +421635,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -420506,44 +421892,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -420576,31 +421961,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -420636,9 +422022,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -420695,27 +422083,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -420939,8 +422329,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -421005,18 +422395,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -421883,57 +423274,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -421950,52 +423342,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -422070,7 +423461,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -422326,44 +423718,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -422396,31 +423787,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -422456,9 +423848,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -422515,27 +423909,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -422759,8 +424155,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -422825,18 +424221,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -423703,57 +425100,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -423770,52 +425168,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -423890,7 +425287,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -424146,44 +425544,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -424216,31 +425613,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -424276,9 +425674,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -424335,27 +425735,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -424579,8 +425981,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -424645,18 +426047,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -425523,57 +426926,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -425590,52 +426994,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -425710,7 +427113,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -425966,44 +427370,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -426036,31 +427439,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -426096,9 +427500,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -426155,27 +427561,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -426399,8 +427807,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -426465,18 +427873,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -427343,57 +428752,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -427410,52 +428820,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -427530,7 +428939,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -427786,44 +429196,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -427856,31 +429265,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -427916,9 +429326,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -427975,27 +429387,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -428219,8 +429633,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -428285,18 +429699,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -429163,57 +430578,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -429230,52 +430646,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -429350,7 +430765,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -429606,44 +431022,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -429676,31 +431091,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -429736,9 +431152,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -429795,27 +431213,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -430039,8 +431459,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -430105,18 +431525,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -430983,57 +432404,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -431050,52 +432472,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -431170,7 +432591,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -431426,44 +432848,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -431496,31 +432917,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -431556,9 +432978,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -431615,27 +433039,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -431859,8 +433285,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -431925,18 +433351,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -432803,57 +434230,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -432870,52 +434298,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -432990,7 +434417,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -433246,44 +434674,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -433316,31 +434743,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -433376,9 +434804,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -433435,27 +434865,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -433679,8 +435111,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -433745,18 +435177,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -434623,57 +436056,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -434690,52 +436124,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -434810,7 +436243,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -435066,44 +436500,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -435136,31 +436569,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -435196,9 +436630,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -435255,27 +436691,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -435499,8 +436937,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -435565,18 +437003,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -436443,57 +437882,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -436510,52 +437950,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -436630,7 +438069,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -436886,44 +438326,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -436956,31 +438395,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -437016,9 +438456,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -437075,27 +438517,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -437319,8 +438763,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -437385,18 +438829,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -438263,57 +439708,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -438330,52 +439776,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -438450,7 +439895,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -438706,44 +440152,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -438776,31 +440221,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -438836,9 +440282,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -438895,27 +440343,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -439139,8 +440589,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -439205,18 +440655,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -440083,57 +441534,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -440150,52 +441602,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -440270,7 +441721,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -440526,44 +441978,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -440596,31 +442047,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -440656,9 +442108,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -440715,27 +442169,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -440959,8 +442415,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -441025,18 +442481,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -441903,57 +443360,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -441970,52 +443428,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -442090,7 +443547,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -442346,44 +443804,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -442416,31 +443873,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -442476,9 +443934,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -442535,27 +443995,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -442779,8 +444241,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -442845,18 +444307,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -443723,57 +445186,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -443790,52 +445254,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -443910,7 +445373,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -444166,44 +445630,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -444236,31 +445699,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -444296,9 +445760,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -444355,27 +445821,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -444599,8 +446067,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -444665,18 +446133,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -445543,57 +447012,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -445610,52 +447080,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -445730,7 +447199,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -445986,44 +447456,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -446056,31 +447525,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -446116,9 +447586,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -446175,27 +447647,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -446419,8 +447893,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -446485,18 +447959,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -447363,57 +448838,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -447430,52 +448906,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -447550,7 +449025,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -447806,44 +449282,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -447876,31 +449351,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -447936,9 +449412,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -447995,27 +449473,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -448239,8 +449719,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -448305,18 +449785,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -449183,57 +450664,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -449250,52 +450732,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -449370,7 +450851,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -449626,44 +451108,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -449696,31 +451177,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -449756,9 +451238,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -449815,27 +451299,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -450059,8 +451545,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -450125,18 +451611,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -451003,57 +452490,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -451070,52 +452558,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -451190,7 +452677,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -451446,44 +452934,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -451516,31 +453003,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -451576,9 +453064,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -451635,27 +453125,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -451879,8 +453371,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -451945,18 +453437,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -452823,57 +454316,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -452890,52 +454384,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -453010,7 +454503,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -453266,44 +454760,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -453336,31 +454829,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -453396,9 +454890,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -453455,27 +454951,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -453699,8 +455197,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -453765,18 +455263,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -454643,57 +456142,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -454710,52 +456210,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -454830,7 +456329,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -455086,44 +456586,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -455156,31 +456655,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -455216,9 +456716,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -455275,27 +456777,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -455519,8 +457023,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -455585,18 +457089,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -456463,57 +457968,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -456530,52 +458036,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -456650,7 +458155,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -456906,44 +458412,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -456976,31 +458481,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -457036,9 +458542,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -457095,27 +458603,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -457339,8 +458849,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -457405,18 +458915,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -458283,57 +459794,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -458350,52 +459862,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -458470,7 +459981,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -458726,44 +460238,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -458796,31 +460307,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -458856,9 +460368,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -458915,27 +460429,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -459159,8 +460675,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -459225,18 +460741,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -460103,57 +461620,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -460170,52 +461688,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -460290,7 +461807,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -460546,44 +462064,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -460616,31 +462133,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -460676,9 +462194,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -460735,27 +462255,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -460979,8 +462501,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -461045,18 +462567,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -461923,57 +463446,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -461990,52 +463514,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -462110,7 +463633,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -462366,44 +463890,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -462436,31 +463959,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -462496,9 +464020,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -462555,27 +464081,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -462799,8 +464327,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -462865,18 +464393,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -463743,57 +465272,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -463810,52 +465340,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -463930,7 +465459,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -464186,44 +465716,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -464256,31 +465785,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -464316,9 +465846,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -464375,27 +465907,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -464619,8 +466153,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -464685,18 +466219,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -465563,57 +467098,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -465630,52 +467166,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -465750,7 +467285,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -466006,44 +467542,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -466076,31 +467611,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -466136,9 +467672,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -466195,27 +467733,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -466439,8 +467979,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -466505,18 +468045,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -467383,57 +468924,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -467450,52 +468992,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -467570,7 +469111,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -467826,44 +469368,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -467896,31 +469437,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -467956,9 +469498,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -468015,27 +469559,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -468259,8 +469805,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -468325,18 +469871,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -469203,57 +470750,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -469270,52 +470818,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -469390,7 +470937,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -469646,44 +471194,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -469716,31 +471263,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -469776,9 +471324,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -469835,27 +471385,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -470079,8 +471631,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -470145,18 +471697,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -471023,57 +472576,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -471090,52 +472644,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -471210,7 +472763,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -471466,44 +473020,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -471536,31 +473089,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -471596,9 +473150,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -471655,27 +473211,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -471899,8 +473457,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -471965,18 +473523,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -472843,57 +474402,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -472910,52 +474470,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -473030,7 +474589,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -473286,44 +474846,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -473356,31 +474915,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -473416,9 +474976,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -473475,27 +475037,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -473719,8 +475283,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -473785,18 +475349,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -474663,57 +476228,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -474730,52 +476296,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -474850,7 +476415,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -475106,44 +476672,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -475176,31 +476741,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -475236,9 +476802,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -475295,27 +476863,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -475539,8 +477109,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -475605,18 +477175,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -476483,57 +478054,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -476550,52 +478122,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -476670,7 +478241,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -476926,44 +478498,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -476996,31 +478567,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -477056,9 +478628,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -477115,27 +478689,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -477359,8 +478935,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -477425,18 +479001,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -478303,57 +479880,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -478370,52 +479948,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -478490,7 +480067,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -478746,44 +480324,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -478816,31 +480393,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -478876,9 +480454,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -478935,27 +480515,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -479179,8 +480761,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -479245,18 +480827,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -480123,57 +481706,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -480190,52 +481774,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -480310,7 +481893,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -480566,44 +482150,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -480636,31 +482219,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -480696,9 +482280,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -480755,27 +482341,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -480999,8 +482587,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -481065,18 +482653,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -481943,57 +483532,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -482010,52 +483600,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -482130,7 +483719,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -482386,44 +483976,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -482456,31 +484045,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -482516,9 +484106,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -482575,27 +484167,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -482819,8 +484413,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -482885,18 +484479,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -483763,57 +485358,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -483830,52 +485426,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -483950,7 +485545,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -484206,44 +485802,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -484276,31 +485871,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -484336,9 +485932,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -484395,27 +485993,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -484639,8 +486239,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -484705,18 +486305,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -485583,57 +487184,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -485650,52 +487252,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -485770,7 +487371,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -486026,44 +487628,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -486096,31 +487697,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -486156,9 +487758,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -486215,27 +487819,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -486459,8 +488065,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -486525,18 +488131,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -487403,57 +489010,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -487470,52 +489078,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -487590,7 +489197,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -487846,44 +489454,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -487916,31 +489523,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -487976,9 +489584,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -488035,27 +489645,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -488279,8 +489891,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -488345,18 +489957,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -489223,57 +490836,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -489290,52 +490904,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -489410,7 +491023,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -489666,44 +491280,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -489736,31 +491349,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -489796,9 +491410,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -489855,27 +491471,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -490099,8 +491717,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -490165,18 +491783,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -491043,57 +492662,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -491110,52 +492730,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -491230,7 +492849,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -491486,44 +493106,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -491556,31 +493175,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -491616,9 +493236,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -491675,27 +493297,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -491919,8 +493543,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -491985,18 +493609,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -492863,57 +494488,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -492930,52 +494556,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -493050,7 +494675,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -493306,44 +494932,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -493376,31 +495001,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -493436,9 +495062,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -493495,27 +495123,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -493739,8 +495369,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -493805,18 +495435,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -494683,57 +496314,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -494750,52 +496382,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -494870,7 +496501,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -495126,44 +496758,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -495196,31 +496827,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -495256,9 +496888,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -495315,27 +496949,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -495559,8 +497195,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -495625,18 +497261,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -496503,57 +498140,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -496570,52 +498208,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -496690,7 +498327,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -496946,44 +498584,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -497016,31 +498653,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -497076,9 +498714,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -497135,27 +498775,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -497379,8 +499021,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -497445,18 +499087,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -498323,57 +499966,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -498390,52 +500034,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -498510,7 +500153,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -498766,44 +500410,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -498836,31 +500479,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -498896,9 +500540,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -498955,27 +500601,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -499199,8 +500847,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -499265,18 +500913,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -500143,57 +501792,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -500210,52 +501860,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -500330,7 +501979,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -500586,44 +502236,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -500656,31 +502305,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -500716,9 +502366,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -500775,27 +502427,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -501019,8 +502673,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -501085,18 +502739,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -501963,57 +503618,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -502030,52 +503686,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -502150,7 +503805,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -502406,44 +504062,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -502476,31 +504131,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -502536,9 +504192,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -502595,27 +504253,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -502839,8 +504499,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -502905,18 +504565,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -503783,57 +505444,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -503850,52 +505512,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -503970,7 +505631,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -504226,44 +505888,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -504296,31 +505957,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -504356,9 +506018,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -504415,27 +506079,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -504659,8 +506325,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -504725,18 +506391,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -505603,57 +507270,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -505670,52 +507338,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -505790,7 +507457,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -506046,44 +507714,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -506116,31 +507783,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -506176,9 +507844,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -506235,27 +507905,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -506479,8 +508151,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -506545,18 +508217,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -507423,57 +509096,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -507490,52 +509164,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -507610,7 +509283,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -507866,44 +509540,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -507936,31 +509609,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -507996,9 +509670,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -508055,27 +509731,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -508299,8 +509977,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -508365,18 +510043,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -509243,57 +510922,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -509310,52 +510990,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -509430,7 +511109,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -509686,44 +511366,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -509756,31 +511435,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -509816,9 +511496,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -509875,27 +511557,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -510119,8 +511803,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -510185,18 +511869,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -511063,57 +512748,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -511130,52 +512816,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -511250,7 +512935,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -511506,44 +513192,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -511576,31 +513261,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -511636,9 +513322,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -511695,27 +513383,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -511939,8 +513629,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -512005,18 +513695,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -512883,57 +514574,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -512950,52 +514642,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -513070,7 +514761,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -513326,44 +515018,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -513396,31 +515087,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -513456,9 +515148,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -513515,27 +515209,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -513759,8 +515455,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -513825,18 +515521,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -514703,57 +516400,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -514770,52 +516468,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -514890,7 +516587,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -515146,44 +516844,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -515216,31 +516913,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -515276,9 +516974,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -515335,27 +517035,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -515579,8 +517281,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -515645,18 +517347,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -516523,57 +518226,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -516590,52 +518294,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -516710,7 +518413,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -516966,44 +518670,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -517036,31 +518739,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -517096,9 +518800,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -517155,27 +518861,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -517399,8 +519107,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -517465,18 +519173,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -518343,57 +520052,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -518410,52 +520120,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -518530,7 +520239,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -518786,44 +520496,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -518856,31 +520565,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -518916,9 +520626,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -518975,27 +520687,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -519219,8 +520933,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -519285,18 +520999,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -520163,57 +521878,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -520230,52 +521946,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -520350,7 +522065,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -520606,44 +522322,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -520676,31 +522391,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -520736,9 +522452,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -520795,27 +522513,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -521039,8 +522759,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -521105,18 +522825,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -521983,57 +523704,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -522050,52 +523772,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -522170,7 +523891,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -522426,44 +524148,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -522496,31 +524217,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -522556,9 +524278,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -522615,27 +524339,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -522859,8 +524585,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -522925,18 +524651,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -523803,57 +525530,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -523870,52 +525598,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -523990,7 +525717,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -524246,44 +525974,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -524316,31 +526043,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -524376,9 +526104,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -524435,27 +526165,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -524679,8 +526411,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -524745,18 +526477,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -525623,57 +527356,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -525690,52 +527424,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -525810,7 +527543,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -526066,44 +527800,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -526136,31 +527869,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -526196,9 +527930,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -526255,27 +527991,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -526499,8 +528237,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -526565,18 +528303,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -527443,57 +529182,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -527510,52 +529250,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -527630,7 +529369,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -527886,44 +529626,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -527956,31 +529695,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -528016,9 +529756,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -528075,27 +529817,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -528319,8 +530063,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -528385,18 +530129,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -529263,57 +531008,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -529330,52 +531076,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -529450,7 +531195,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -529706,44 +531452,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -529776,31 +531521,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -529836,9 +531582,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -529895,27 +531643,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -530139,8 +531889,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -530205,18 +531955,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -531083,57 +532834,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -531150,52 +532902,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -531270,7 +533021,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -531526,44 +533278,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -531596,31 +533347,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -531656,9 +533408,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -531715,27 +533469,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -531959,8 +533715,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -532025,18 +533781,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -532903,57 +534660,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -532970,52 +534728,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -533090,7 +534847,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -533346,44 +535104,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -533416,31 +535173,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -533476,9 +535234,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -533535,27 +535295,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -533779,8 +535541,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -533845,18 +535607,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -534723,57 +536486,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -534790,52 +536554,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -534910,7 +536673,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -535166,44 +536930,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -535236,31 +536999,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -535296,9 +537060,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -535355,27 +537121,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -535599,8 +537367,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -535665,18 +537433,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -536543,57 +538312,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -536610,52 +538380,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -536730,7 +538499,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -536986,44 +538756,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -537056,31 +538825,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -537116,9 +538886,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -537175,27 +538947,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -537419,8 +539193,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -537485,18 +539259,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -538363,57 +540138,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -538430,52 +540206,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -538550,7 +540325,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -538806,44 +540582,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -538876,31 +540651,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -538936,9 +540712,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -538995,27 +540773,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -539239,8 +541019,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -539305,18 +541085,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -540183,57 +541964,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -540250,52 +542032,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -540370,7 +542151,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -540626,44 +542408,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -540696,31 +542477,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -540756,9 +542538,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -540815,27 +542599,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -541059,8 +542845,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -541125,18 +542911,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -542003,57 +543790,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -542070,52 +543858,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -542190,7 +543977,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -542446,44 +544234,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -542516,31 +544303,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -542576,9 +544364,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -542635,27 +544425,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -542879,8 +544671,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -542945,18 +544737,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -543823,57 +545616,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -543890,52 +545684,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -544010,7 +545803,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -544266,44 +546060,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -544336,31 +546129,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -544396,9 +546190,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -544455,27 +546251,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -544699,8 +546497,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -544765,18 +546563,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -545643,57 +547442,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -545710,52 +547510,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -545830,7 +547629,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -546086,44 +547886,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -546156,31 +547955,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -546216,9 +548016,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -546275,27 +548077,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -546519,8 +548323,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -546585,18 +548389,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -547463,57 +549268,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -547530,52 +549336,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -547650,7 +549455,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -547906,44 +549712,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -547976,31 +549781,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -548036,9 +549842,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -548095,27 +549903,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -548339,8 +550149,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -548405,18 +550215,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -549283,57 +551094,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -549350,52 +551162,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -549470,7 +551281,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -549726,44 +551538,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -549796,31 +551607,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -549856,9 +551668,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -549915,27 +551729,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -550159,8 +551975,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -550225,18 +552041,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -551103,57 +552920,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -551170,52 +552988,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -551290,7 +553107,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -551546,44 +553364,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -551616,31 +553433,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -551676,9 +553494,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -551735,27 +553555,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -551979,8 +553801,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -552045,18 +553867,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -552923,57 +554746,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -552990,52 +554814,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -553110,7 +554933,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -553366,44 +555190,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -553436,31 +555259,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -553496,9 +555320,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -553555,27 +555381,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -553799,8 +555627,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -553865,18 +555693,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -554743,57 +556572,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -554810,52 +556640,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -554930,7 +556759,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -555186,44 +557016,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -555256,31 +557085,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -555316,9 +557146,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -555375,27 +557207,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -555619,8 +557453,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -555685,18 +557519,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -556563,57 +558398,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -556630,52 +558466,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -556750,7 +558585,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -557006,44 +558842,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -557076,31 +558911,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -557136,9 +558972,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -557195,27 +559033,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -557439,8 +559279,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -557505,18 +559345,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -558383,57 +560224,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -558450,52 +560292,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -558570,7 +560411,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -558826,44 +560668,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -558896,31 +560737,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -558956,9 +560798,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -559015,27 +560859,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -559259,8 +561105,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -559325,18 +561171,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -560203,57 +562050,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -560270,52 +562118,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -560390,7 +562237,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -560646,44 +562494,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -560716,31 +562563,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -560776,9 +562624,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -560835,27 +562685,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -561079,8 +562931,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -561145,18 +562997,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -562023,57 +563876,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -562090,52 +563944,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -562210,7 +564063,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -562466,44 +564320,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -562536,31 +564389,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -562596,9 +564450,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -562655,27 +564511,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -562899,8 +564757,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -562965,18 +564823,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -563843,57 +565702,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -563910,52 +565770,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -564030,7 +565889,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -564286,44 +566146,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -564356,31 +566215,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -564416,9 +566276,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -564475,27 +566337,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -564719,8 +566583,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -564785,18 +566649,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -565663,57 +567528,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -565730,52 +567596,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -565850,7 +567715,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -566106,44 +567972,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -566176,31 +568041,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -566236,9 +568102,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -566295,27 +568163,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -566539,8 +568409,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -566605,18 +568475,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -567483,57 +569354,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -567550,52 +569422,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -567670,7 +569541,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -567926,44 +569798,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -567996,31 +569867,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -568056,9 +569928,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -568115,27 +569989,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -568359,8 +570235,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -568425,18 +570301,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -569303,57 +571180,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -569370,52 +571248,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -569490,7 +571367,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -569746,44 +571624,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -569816,31 +571693,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -569876,9 +571754,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -569935,27 +571815,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -570179,8 +572061,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -570245,18 +572127,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -571123,57 +573006,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -571190,52 +573074,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -571310,7 +573193,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -571566,44 +573450,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -571636,31 +573519,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -571696,9 +573580,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -571755,27 +573641,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -571999,8 +573887,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -572065,18 +573953,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -572943,57 +574832,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -573010,52 +574900,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -573130,7 +575019,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -573386,44 +575276,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -573456,31 +575345,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -573516,9 +575406,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -573575,27 +575467,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -573819,8 +575713,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -573885,18 +575779,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -574763,57 +576658,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -574830,52 +576726,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -574950,7 +576845,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -575206,44 +577102,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -575276,31 +577171,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -575336,9 +577232,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -575395,27 +577293,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -575639,8 +577539,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -575705,18 +577605,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -576583,57 +578484,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -576650,52 +578552,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -576770,7 +578671,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -577026,44 +578928,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -577096,31 +578997,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -577156,9 +579058,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -577215,27 +579119,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -577459,8 +579365,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -577525,18 +579431,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -578403,57 +580310,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -578470,52 +580378,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -578590,7 +580497,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -578846,44 +580754,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -578916,31 +580823,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -578976,9 +580884,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -579035,27 +580945,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -579279,8 +581191,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -579345,18 +581257,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -580223,57 +582136,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -580290,52 +582204,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -580410,7 +582323,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -580666,44 +582580,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -580736,31 +582649,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -580796,9 +582710,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -580855,27 +582771,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -581099,8 +583017,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -581165,18 +583083,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -582043,57 +583962,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -582110,52 +584030,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -582230,7 +584149,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -582486,44 +584406,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -582556,31 +584475,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -582616,9 +584536,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -582675,27 +584597,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -582919,8 +584843,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -582985,18 +584909,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -583863,57 +585788,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -583930,52 +585856,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -584050,7 +585975,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -584306,44 +586232,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -584376,31 +586301,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -584436,9 +586362,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -584495,27 +586423,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -584739,8 +586669,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -584805,18 +586735,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -585683,57 +587614,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -585750,52 +587682,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -585870,7 +587801,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -586126,44 +588058,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -586196,31 +588127,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -586256,9 +588188,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -586315,27 +588249,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -586559,8 +588495,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -586625,18 +588561,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -587503,57 +589440,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -587570,52 +589508,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -587690,7 +589627,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -587946,44 +589884,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -588016,31 +589953,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -588076,9 +590014,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -588135,27 +590075,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -588379,8 +590321,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -588445,18 +590387,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -589323,57 +591266,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -589390,52 +591334,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -589510,7 +591453,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -589766,44 +591710,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -589836,31 +591779,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -589896,9 +591840,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -589955,27 +591901,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -590199,8 +592147,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -590265,18 +592213,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -591143,57 +593092,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -591210,52 +593160,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -591330,7 +593279,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -591586,44 +593536,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -591656,31 +593605,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -591716,9 +593666,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -591775,27 +593727,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -592019,8 +593973,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -592085,18 +594039,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -592963,57 +594918,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -593030,52 +594986,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -593150,7 +595105,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -593406,44 +595362,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -593476,31 +595431,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -593536,9 +595492,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -593595,27 +595553,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -593839,8 +595799,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -593905,18 +595865,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -594783,57 +596744,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -594850,52 +596812,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -594970,7 +596931,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -595226,44 +597188,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -595296,31 +597257,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -595356,9 +597318,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -595415,27 +597379,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -595659,8 +597625,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -595725,18 +597691,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -596603,57 +598570,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -596670,52 +598638,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -596790,7 +598757,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -597046,44 +599014,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -597116,31 +599083,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -597176,9 +599144,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -597235,27 +599205,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -597479,8 +599451,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -597545,18 +599517,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -598423,57 +600396,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -598490,52 +600464,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -598610,7 +600583,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -598866,44 +600840,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -598936,31 +600909,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -598996,9 +600970,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -599055,27 +601031,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -599299,8 +601277,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -599365,18 +601343,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -600243,57 +602222,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -600310,52 +602290,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -600430,7 +602409,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -600686,44 +602666,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -600756,31 +602735,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -600816,9 +602796,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -600875,27 +602857,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -601119,8 +603103,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -601185,18 +603169,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -602063,57 +604048,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -602130,52 +604116,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -602250,7 +604235,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -602506,44 +604492,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -602576,31 +604561,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -602636,9 +604622,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -602695,27 +604683,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -602939,8 +604929,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -603005,18 +604995,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -603883,57 +605874,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -603950,52 +605942,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -604070,7 +606061,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -604326,44 +606318,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -604396,31 +606387,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -604456,9 +606448,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -604515,27 +606509,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -604759,8 +606755,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -604825,18 +606821,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -605703,57 +607700,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -605770,52 +607768,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -605890,7 +607887,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -606146,44 +608144,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -606216,31 +608213,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -606276,9 +608274,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -606335,27 +608335,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -606579,8 +608581,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -606645,18 +608647,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -607523,57 +609526,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -607590,52 +609594,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -607710,7 +609713,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -607966,44 +609970,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -608036,31 +610039,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -608096,9 +610100,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -608155,27 +610161,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -608399,8 +610407,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -608465,18 +610473,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -609343,57 +611352,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -609410,52 +611420,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -609530,7 +611539,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -609786,44 +611796,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -609856,31 +611865,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -609916,9 +611926,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -609975,27 +611987,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -610219,8 +612233,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -610285,18 +612299,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -611163,57 +613178,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -611230,52 +613246,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -611350,7 +613365,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -611606,44 +613622,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -611676,31 +613691,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -611736,9 +613752,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -611795,27 +613813,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -612039,8 +614059,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -612105,18 +614125,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -612983,57 +615004,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -613050,52 +615072,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -613170,7 +615191,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -613426,44 +615448,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -613496,31 +615517,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -613556,9 +615578,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -613615,27 +615639,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -613859,8 +615885,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -613925,18 +615951,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -614803,57 +616830,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -614870,52 +616898,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -614990,7 +617017,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -615246,44 +617274,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -615316,31 +617343,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -615376,9 +617404,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -615435,27 +617465,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -615679,8 +617711,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -615745,18 +617777,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -616623,57 +618656,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -616690,52 +618724,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -616810,7 +618843,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -617066,44 +619100,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -617136,31 +619169,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -617196,9 +619230,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -617255,27 +619291,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -617499,8 +619537,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -617565,18 +619603,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -618443,57 +620482,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -618510,52 +620550,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -618630,7 +620669,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -618886,44 +620926,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -618956,31 +620995,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -619016,9 +621056,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -619075,27 +621117,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -619319,8 +621363,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -619385,18 +621429,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -620263,57 +622308,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -620330,52 +622376,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -620450,7 +622495,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -620706,44 +622752,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -620776,31 +622821,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -620836,9 +622882,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -620895,27 +622943,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -621139,8 +623189,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -621205,18 +623255,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -622083,57 +624134,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -622150,52 +624202,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -622270,7 +624321,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -622526,44 +624578,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -622596,31 +624647,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -622656,9 +624708,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -622715,27 +624769,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -622959,8 +625015,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -623025,18 +625081,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -623903,57 +625960,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -623970,52 +626028,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -624090,7 +626147,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -624346,44 +626404,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -624416,31 +626473,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -624476,9 +626534,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -624535,27 +626595,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -624779,8 +626841,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -624845,18 +626907,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -625723,57 +627786,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -625790,52 +627854,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -625910,7 +627973,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -626166,44 +628230,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -626236,31 +628299,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -626296,9 +628360,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -626355,27 +628421,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -626599,8 +628667,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -626665,18 +628733,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -627543,57 +629612,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -627610,52 +629680,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -627730,7 +629799,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -627986,44 +630056,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -628056,31 +630125,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -628116,9 +630186,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -628175,27 +630247,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -628419,8 +630493,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -628485,18 +630559,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -629363,57 +631438,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -629430,52 +631506,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -629550,7 +631625,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -629806,44 +631882,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -629876,31 +631951,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -629936,9 +632012,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -629995,27 +632073,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -630239,8 +632319,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -630305,18 +632385,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -631183,57 +633264,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -631250,52 +633332,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -631370,7 +633451,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -631626,44 +633708,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -631696,31 +633777,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -631756,9 +633838,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -631815,27 +633899,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -632059,8 +634145,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -632125,18 +634211,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -633003,57 +635090,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -633070,52 +635158,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -633190,7 +635277,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -633446,44 +635534,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -633516,31 +635603,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -633576,9 +635664,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -633635,27 +635725,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -633879,8 +635971,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -633945,18 +636037,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -634823,57 +636916,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -634890,52 +636984,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -635010,7 +637103,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -635266,44 +637360,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -635336,31 +637429,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -635396,9 +637490,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -635455,27 +637551,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -635699,8 +637797,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -635765,18 +637863,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -636643,57 +638742,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -636710,52 +638810,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -636830,7 +638929,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -637086,44 +639186,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -637156,31 +639255,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -637216,9 +639316,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -637275,27 +639377,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -637519,8 +639623,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -637585,18 +639689,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -638463,57 +640568,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -638530,52 +640636,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -638650,7 +640755,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -638906,44 +641012,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -638976,31 +641081,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -639036,9 +641142,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -639095,27 +641203,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -639339,8 +641449,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -639405,18 +641515,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -640283,57 +642394,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -640350,52 +642462,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -640470,7 +642581,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -640726,44 +642838,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -640796,31 +642907,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -640856,9 +642968,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -640915,27 +643029,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -641159,8 +643275,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -641225,18 +643341,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -642103,57 +644220,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -642170,52 +644288,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -642290,7 +644407,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -642546,44 +644664,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -642616,31 +644733,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -642676,9 +644794,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -642735,27 +644855,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -642979,8 +645101,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -643045,18 +645167,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -643923,57 +646046,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -643990,52 +646114,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -644110,7 +646233,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -644366,44 +646490,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -644436,31 +646559,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -644496,9 +646620,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -644555,27 +646681,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -644799,8 +646927,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -644865,18 +646993,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -645743,57 +647872,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -645810,52 +647940,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -645930,7 +648059,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -646186,44 +648316,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -646256,31 +648385,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -646316,9 +648446,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -646375,27 +648507,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -646619,8 +648753,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -646685,18 +648819,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -647563,57 +649698,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -647630,52 +649766,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -647750,7 +649885,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -648006,44 +650142,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -648076,31 +650211,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -648136,9 +650272,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -648195,27 +650333,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -648439,8 +650579,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -648505,18 +650645,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -649383,57 +651524,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -649450,52 +651592,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -649570,7 +651711,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -649826,44 +651968,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -649896,31 +652037,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -649956,9 +652098,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -650015,27 +652159,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -650259,8 +652405,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -650325,18 +652471,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -651203,57 +653350,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -651270,52 +653418,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -651390,7 +653537,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -651646,44 +653794,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -651716,31 +653863,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -651776,9 +653924,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -651835,27 +653985,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -652079,8 +654231,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -652145,18 +654297,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -653023,57 +655176,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -653090,52 +655244,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -653210,7 +655363,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -653466,44 +655620,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -653536,31 +655689,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -653596,9 +655750,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -653655,27 +655811,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -653899,8 +656057,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -653965,18 +656123,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -654843,57 +657002,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -654910,52 +657070,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -655030,7 +657189,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -655286,44 +657446,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -655356,31 +657515,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -655416,9 +657576,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -655475,27 +657637,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -655719,8 +657883,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -655785,18 +657949,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -656663,57 +658828,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -656730,52 +658896,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -656850,7 +659015,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -657106,44 +659272,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -657176,31 +659341,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -657236,9 +659402,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -657295,27 +659463,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -657539,8 +659709,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -657605,18 +659775,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -658483,57 +660654,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -658550,52 +660722,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -658670,7 +660841,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -658926,44 +661098,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -658996,31 +661167,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -659056,9 +661228,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -659115,27 +661289,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -659359,8 +661535,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -659425,18 +661601,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -660303,57 +662480,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -660370,52 +662548,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -660490,7 +662667,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -660746,44 +662924,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -660816,31 +662993,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -660876,9 +663054,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -660935,27 +663115,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -661179,8 +663361,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -661245,18 +663427,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -662123,57 +664306,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -662190,52 +664374,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -662310,7 +664493,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -662566,44 +664750,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -662636,31 +664819,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -662696,9 +664880,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -662755,27 +664941,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -662999,8 +665187,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -663065,18 +665253,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -663943,57 +666132,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -664010,52 +666200,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -664130,7 +666319,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -664386,44 +666576,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -664456,31 +666645,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -664516,9 +666706,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -664575,27 +666767,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -664819,8 +667013,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -664885,18 +667079,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -665763,57 +667958,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -665830,52 +668026,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -665950,7 +668145,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -666206,44 +668402,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -666276,31 +668471,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -666336,9 +668532,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -666395,27 +668593,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -666639,8 +668839,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -666705,18 +668905,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -667583,57 +669784,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -667650,52 +669852,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -667770,7 +669971,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -668026,44 +670228,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -668096,31 +670297,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -668156,9 +670358,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -668215,27 +670419,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -668459,8 +670665,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -668525,18 +670731,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -669403,57 +671610,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -669470,52 +671678,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -669590,7 +671797,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -669846,44 +672054,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -669916,31 +672123,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -669976,9 +672184,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -670035,27 +672245,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -670279,8 +672491,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -670345,18 +672557,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -671223,57 +673436,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -671290,52 +673504,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -671410,7 +673623,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -671666,44 +673880,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -671736,31 +673949,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -671796,9 +674010,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -671855,27 +674071,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -672099,8 +674317,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -672165,18 +674383,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -673043,57 +675262,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -673110,52 +675330,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -673230,7 +675449,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -673486,44 +675706,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -673556,31 +675775,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -673616,9 +675836,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -673675,27 +675897,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -673919,8 +676143,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -673985,18 +676209,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -674863,57 +677088,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -674930,52 +677156,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -675050,7 +677275,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -675306,44 +677532,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -675376,31 +677601,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -675436,9 +677662,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -675495,27 +677723,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -675739,8 +677969,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -675805,18 +678035,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -676683,57 +678914,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -676750,52 +678982,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -676870,7 +679101,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -677126,44 +679358,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -677196,31 +679427,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -677256,9 +679488,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -677315,27 +679549,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -677559,8 +679795,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -677625,18 +679861,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -678503,57 +680740,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -678570,52 +680808,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -678690,7 +680927,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -678946,44 +681184,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -679016,31 +681253,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -679076,9 +681314,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -679135,27 +681375,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -679379,8 +681621,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -679445,18 +681687,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -680323,57 +682566,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -680390,52 +682634,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -680510,7 +682753,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -680766,44 +683010,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -680836,31 +683079,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -680896,9 +683140,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -680955,27 +683201,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -681199,8 +683447,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -681265,18 +683513,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -682143,57 +684392,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -682210,52 +684460,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -682330,7 +684579,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -682586,44 +684836,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -682656,31 +684905,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -682716,9 +684966,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -682775,27 +685027,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -683019,8 +685273,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -683085,18 +685339,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -683963,57 +686218,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -684030,52 +686286,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -684150,7 +686405,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -684406,44 +686662,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -684476,31 +686731,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -684536,9 +686792,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -684595,27 +686853,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -684839,8 +687099,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -684905,18 +687165,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -685783,57 +688044,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -685850,52 +688112,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -685970,7 +688231,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -686226,44 +688488,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -686296,31 +688557,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -686356,9 +688618,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -686415,27 +688679,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -686659,8 +688925,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -686725,18 +688991,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -687603,57 +689870,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -687670,52 +689938,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -687790,7 +690057,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -688046,44 +690314,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -688116,31 +690383,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -688176,9 +690444,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -688235,27 +690505,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -688479,8 +690751,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -688545,18 +690817,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -689423,57 +691696,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -689490,52 +691764,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -689610,7 +691883,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index 5b160993f2..4372832f39 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -79,8 +79,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -124,8 +124,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -173,8 +173,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -198,8 +198,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -410,7 +410,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -450,8 +450,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -1276,8 +1276,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -1298,8 +1298,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -1402,8 +1402,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -1626,8 +1626,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -1671,8 +1671,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -1720,8 +1720,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -1745,8 +1745,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -1957,7 +1957,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -1997,8 +1997,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -2823,8 +2823,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -2845,8 +2845,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -2949,8 +2949,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -3173,8 +3173,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -3218,8 +3218,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -3267,8 +3267,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -3292,8 +3292,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -3504,7 +3504,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -3544,8 +3544,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -4370,8 +4370,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -4392,8 +4392,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -4496,8 +4496,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -4720,8 +4720,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -4765,8 +4765,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -4814,8 +4814,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -4839,8 +4839,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -5051,7 +5051,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -5091,8 +5091,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -5917,8 +5917,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -5939,8 +5939,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -6043,8 +6043,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -6267,8 +6267,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -6312,8 +6312,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -6361,8 +6361,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -6386,8 +6386,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -6598,7 +6598,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -6638,8 +6638,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -7464,8 +7464,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -7486,8 +7486,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -7590,8 +7590,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -7814,8 +7814,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -7859,8 +7859,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -7908,8 +7908,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -7933,8 +7933,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -8145,7 +8145,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -8185,8 +8185,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -9011,8 +9011,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -9033,8 +9033,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -9137,8 +9137,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -9361,8 +9361,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -9406,8 +9406,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -9455,8 +9455,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -9480,8 +9480,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -9692,7 +9692,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -9732,8 +9732,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -10558,8 +10558,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -10580,8 +10580,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -10684,8 +10684,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -10908,8 +10908,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -10953,8 +10953,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -11002,8 +11002,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -11027,8 +11027,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -11239,7 +11239,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -11279,8 +11279,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -12105,8 +12105,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -12127,8 +12127,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -12231,8 +12231,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -12455,8 +12455,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -12500,8 +12500,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -12549,8 +12549,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -12574,8 +12574,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -12786,7 +12786,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -12826,8 +12826,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -13652,8 +13652,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -13674,8 +13674,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -13778,8 +13778,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -14002,8 +14002,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -14047,8 +14047,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -14096,8 +14096,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -14121,8 +14121,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -14333,7 +14333,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -14373,8 +14373,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -15199,8 +15199,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -15221,8 +15221,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -15325,8 +15325,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -15549,8 +15549,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -15594,8 +15594,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -15643,8 +15643,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -15668,8 +15668,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -15880,7 +15880,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -15920,8 +15920,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -16746,8 +16746,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -16768,8 +16768,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -16872,8 +16872,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -17096,8 +17096,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -17141,8 +17141,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -17190,8 +17190,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -17215,8 +17215,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -17427,7 +17427,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -17467,8 +17467,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -18293,8 +18293,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -18315,8 +18315,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -18419,8 +18419,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -18643,8 +18643,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -18688,8 +18688,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -18737,8 +18737,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -18762,8 +18762,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -18974,7 +18974,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -19014,8 +19014,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -19840,8 +19840,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -19862,8 +19862,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -19966,8 +19966,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -20190,8 +20190,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -20235,8 +20235,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -20284,8 +20284,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -20309,8 +20309,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -20521,7 +20521,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -20561,8 +20561,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -21387,8 +21387,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -21409,8 +21409,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -21513,8 +21513,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -21737,8 +21737,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -21782,8 +21782,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -21831,8 +21831,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -21856,8 +21856,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -22068,7 +22068,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -22108,8 +22108,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -22934,8 +22934,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -22956,8 +22956,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -23060,8 +23060,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -23284,8 +23284,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -23329,8 +23329,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -23378,8 +23378,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -23403,8 +23403,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -23615,7 +23615,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -23655,8 +23655,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -24481,8 +24481,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -24503,8 +24503,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -24607,8 +24607,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -24831,8 +24831,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -24876,8 +24876,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -24925,8 +24925,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -24950,8 +24950,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -25162,7 +25162,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -25202,8 +25202,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -26028,8 +26028,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -26050,8 +26050,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -26154,8 +26154,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -26378,8 +26378,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -26423,8 +26423,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -26472,8 +26472,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -26497,8 +26497,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -26709,7 +26709,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -26749,8 +26749,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -27575,8 +27575,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -27597,8 +27597,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -27701,8 +27701,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -27925,8 +27925,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -27970,8 +27970,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -28019,8 +28019,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -28044,8 +28044,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -28256,7 +28256,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -28296,8 +28296,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -29122,8 +29122,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -29144,8 +29144,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -29248,8 +29248,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -29472,8 +29472,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -29517,8 +29517,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -29566,8 +29566,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -29591,8 +29591,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -29803,7 +29803,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -29843,8 +29843,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -30669,8 +30669,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -30691,8 +30691,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -30795,8 +30795,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -31019,8 +31019,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -31064,8 +31064,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -31113,8 +31113,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -31138,8 +31138,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -31350,7 +31350,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -31390,8 +31390,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -32216,8 +32216,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -32238,8 +32238,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -32342,8 +32342,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -32566,8 +32566,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -32611,8 +32611,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -32660,8 +32660,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -32685,8 +32685,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -32897,7 +32897,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -32937,8 +32937,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -33763,8 +33763,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -33785,8 +33785,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -33889,8 +33889,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -34113,8 +34113,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -34158,8 +34158,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -34207,8 +34207,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -34232,8 +34232,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -34444,7 +34444,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -34484,8 +34484,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -35310,8 +35310,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -35332,8 +35332,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -35436,8 +35436,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -35660,8 +35660,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -35705,8 +35705,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -35754,8 +35754,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -35779,8 +35779,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -35991,7 +35991,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -36031,8 +36031,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -36857,8 +36857,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -36879,8 +36879,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -36983,8 +36983,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -37207,8 +37207,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -37252,8 +37252,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -37301,8 +37301,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -37326,8 +37326,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -37538,7 +37538,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -37578,8 +37578,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -38404,8 +38404,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -38426,8 +38426,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -38530,8 +38530,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -38754,8 +38754,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -38799,8 +38799,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -38848,8 +38848,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -38873,8 +38873,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -39085,7 +39085,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -39125,8 +39125,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -39951,8 +39951,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -39973,8 +39973,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -40077,8 +40077,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -40301,8 +40301,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -40346,8 +40346,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -40395,8 +40395,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -40420,8 +40420,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -40632,7 +40632,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -40672,8 +40672,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -41498,8 +41498,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -41520,8 +41520,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -41624,8 +41624,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -41848,8 +41848,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -41893,8 +41893,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -41942,8 +41942,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -41967,8 +41967,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -42179,7 +42179,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -42219,8 +42219,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -43045,8 +43045,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -43067,8 +43067,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -43171,8 +43171,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -43395,8 +43395,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -43440,8 +43440,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -43489,8 +43489,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -43514,8 +43514,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -43726,7 +43726,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -43766,8 +43766,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -44592,8 +44592,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -44614,8 +44614,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -44718,8 +44718,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -44942,8 +44942,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -44987,8 +44987,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -45036,8 +45036,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -45061,8 +45061,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -45273,7 +45273,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -45313,8 +45313,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -46139,8 +46139,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -46161,8 +46161,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -46265,8 +46265,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -46489,8 +46489,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -46534,8 +46534,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -46583,8 +46583,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -46608,8 +46608,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -46820,7 +46820,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -46860,8 +46860,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -47686,8 +47686,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -47708,8 +47708,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -47812,8 +47812,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -48036,8 +48036,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -48081,8 +48081,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -48130,8 +48130,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -48155,8 +48155,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -48367,7 +48367,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -48407,8 +48407,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -49233,8 +49233,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -49255,8 +49255,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -49359,8 +49359,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -49583,8 +49583,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -49628,8 +49628,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -49677,8 +49677,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -49702,8 +49702,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -49914,7 +49914,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -49954,8 +49954,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -50780,8 +50780,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -50802,8 +50802,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -50906,8 +50906,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -51130,8 +51130,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -51175,8 +51175,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -51224,8 +51224,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -51249,8 +51249,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -51461,7 +51461,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -51501,8 +51501,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -52327,8 +52327,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -52349,8 +52349,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -52453,8 +52453,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -52677,8 +52677,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -52722,8 +52722,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -52771,8 +52771,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -52796,8 +52796,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -53008,7 +53008,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -53048,8 +53048,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -53874,8 +53874,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -53896,8 +53896,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -54000,8 +54000,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -54224,8 +54224,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -54269,8 +54269,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -54318,8 +54318,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -54343,8 +54343,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -54555,7 +54555,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -54595,8 +54595,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -55421,8 +55421,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -55443,8 +55443,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -55547,8 +55547,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -55771,8 +55771,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -55816,8 +55816,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -55865,8 +55865,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -55890,8 +55890,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -56102,7 +56102,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -56142,8 +56142,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -56968,8 +56968,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -56990,8 +56990,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -57094,8 +57094,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -57318,8 +57318,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -57363,8 +57363,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -57412,8 +57412,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -57437,8 +57437,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -57649,7 +57649,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -57689,8 +57689,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -58515,8 +58515,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -58537,8 +58537,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -58641,8 +58641,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -58865,8 +58865,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -58910,8 +58910,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -58959,8 +58959,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -58984,8 +58984,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -59196,7 +59196,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -59236,8 +59236,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -60062,8 +60062,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -60084,8 +60084,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -60188,8 +60188,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -60412,8 +60412,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -60457,8 +60457,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -60506,8 +60506,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -60531,8 +60531,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -60743,7 +60743,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -60783,8 +60783,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -61609,8 +61609,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -61631,8 +61631,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -61735,8 +61735,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -61959,8 +61959,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -62004,8 +62004,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -62053,8 +62053,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -62078,8 +62078,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -62290,7 +62290,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -62330,8 +62330,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -63156,8 +63156,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -63178,8 +63178,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -63282,8 +63282,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -63506,8 +63506,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -63551,8 +63551,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -63600,8 +63600,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -63625,8 +63625,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -63837,7 +63837,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -63877,8 +63877,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -64703,8 +64703,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -64725,8 +64725,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -64829,8 +64829,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -65053,8 +65053,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -65098,8 +65098,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -65147,8 +65147,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -65172,8 +65172,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -65384,7 +65384,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -65424,8 +65424,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -66250,8 +66250,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -66272,8 +66272,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -66376,8 +66376,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -66600,8 +66600,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -66645,8 +66645,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -66694,8 +66694,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -66719,8 +66719,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -66931,7 +66931,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -66971,8 +66971,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -67797,8 +67797,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -67819,8 +67819,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -67923,8 +67923,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -68147,8 +68147,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -68192,8 +68192,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -68241,8 +68241,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -68266,8 +68266,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -68478,7 +68478,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -68518,8 +68518,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -69344,8 +69344,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -69366,8 +69366,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -69470,8 +69470,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -69694,8 +69694,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -69739,8 +69739,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -69788,8 +69788,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -69813,8 +69813,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -70025,7 +70025,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -70065,8 +70065,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -70891,8 +70891,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -70913,8 +70913,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -71017,8 +71017,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -71241,8 +71241,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -71286,8 +71286,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -71335,8 +71335,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -71360,8 +71360,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -71572,7 +71572,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -71612,8 +71612,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -72438,8 +72438,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -72460,8 +72460,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -72564,8 +72564,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -72788,8 +72788,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -72833,8 +72833,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -72882,8 +72882,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -72907,8 +72907,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -73119,7 +73119,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -73159,8 +73159,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -73985,8 +73985,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -74007,8 +74007,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -74111,8 +74111,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -74335,8 +74335,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -74380,8 +74380,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -74429,8 +74429,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -74454,8 +74454,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -74666,7 +74666,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -74706,8 +74706,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -75532,8 +75532,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -75554,8 +75554,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -75658,8 +75658,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -75882,8 +75882,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -75927,8 +75927,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -75976,8 +75976,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -76001,8 +76001,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -76213,7 +76213,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -76253,8 +76253,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -77079,8 +77079,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -77101,8 +77101,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -77205,8 +77205,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -77429,8 +77429,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -77474,8 +77474,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -77523,8 +77523,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -77548,8 +77548,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -77760,7 +77760,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -77800,8 +77800,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -78626,8 +78626,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -78648,8 +78648,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -78752,8 +78752,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -78976,8 +78976,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -79021,8 +79021,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -79070,8 +79070,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -79095,8 +79095,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -79307,7 +79307,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -79347,8 +79347,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -80173,8 +80173,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -80195,8 +80195,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -80299,8 +80299,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -80523,8 +80523,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -80568,8 +80568,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -80617,8 +80617,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -80642,8 +80642,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -80854,7 +80854,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -80894,8 +80894,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -81720,8 +81720,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -81742,8 +81742,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -81846,8 +81846,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -82070,8 +82070,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -82115,8 +82115,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -82164,8 +82164,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -82189,8 +82189,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -82401,7 +82401,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -82441,8 +82441,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -83267,8 +83267,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -83289,8 +83289,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -83393,8 +83393,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -83617,8 +83617,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -83662,8 +83662,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -83711,8 +83711,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -83736,8 +83736,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -83948,7 +83948,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -83988,8 +83988,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -84814,8 +84814,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -84836,8 +84836,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -84940,8 +84940,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -85164,8 +85164,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -85209,8 +85209,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -85258,8 +85258,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -85283,8 +85283,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -85495,7 +85495,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -85535,8 +85535,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -86361,8 +86361,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -86383,8 +86383,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -86487,8 +86487,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -86711,8 +86711,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -86756,8 +86756,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -86805,8 +86805,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -86830,8 +86830,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -87042,7 +87042,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -87082,8 +87082,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -87908,8 +87908,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -87930,8 +87930,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -88034,8 +88034,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -88258,8 +88258,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -88303,8 +88303,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -88352,8 +88352,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -88377,8 +88377,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -88589,7 +88589,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -88629,8 +88629,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -89455,8 +89455,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -89477,8 +89477,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -89581,8 +89581,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -89805,8 +89805,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -89850,8 +89850,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -89899,8 +89899,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -89924,8 +89924,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -90136,7 +90136,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -90176,8 +90176,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -91002,8 +91002,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -91024,8 +91024,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -91128,8 +91128,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -91352,8 +91352,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -91397,8 +91397,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -91446,8 +91446,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -91471,8 +91471,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -91683,7 +91683,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -91723,8 +91723,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -92549,8 +92549,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -92571,8 +92571,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -92675,8 +92675,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -92899,8 +92899,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -92944,8 +92944,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -92993,8 +92993,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -93018,8 +93018,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -93230,7 +93230,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -93270,8 +93270,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -94096,8 +94096,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -94118,8 +94118,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -94222,8 +94222,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -94446,8 +94446,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -94491,8 +94491,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -94540,8 +94540,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -94565,8 +94565,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -94777,7 +94777,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -94817,8 +94817,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -95643,8 +95643,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -95665,8 +95665,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -95769,8 +95769,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -95993,8 +95993,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -96038,8 +96038,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -96087,8 +96087,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -96112,8 +96112,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -96324,7 +96324,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -96364,8 +96364,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -97190,8 +97190,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -97212,8 +97212,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -97316,8 +97316,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -97540,8 +97540,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -97585,8 +97585,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -97634,8 +97634,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -97659,8 +97659,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -97871,7 +97871,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -97911,8 +97911,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -98737,8 +98737,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -98759,8 +98759,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -98863,8 +98863,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -99087,8 +99087,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -99132,8 +99132,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -99181,8 +99181,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -99206,8 +99206,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -99418,7 +99418,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -99458,8 +99458,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -100284,8 +100284,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -100306,8 +100306,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -100410,8 +100410,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -100634,8 +100634,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -100679,8 +100679,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -100728,8 +100728,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -100753,8 +100753,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -100965,7 +100965,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -101005,8 +101005,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -101831,8 +101831,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -101853,8 +101853,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -101957,8 +101957,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -102181,8 +102181,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -102226,8 +102226,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -102275,8 +102275,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -102300,8 +102300,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -102512,7 +102512,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -102552,8 +102552,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -103378,8 +103378,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -103400,8 +103400,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -103504,8 +103504,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -103728,8 +103728,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -103773,8 +103773,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -103822,8 +103822,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -103847,8 +103847,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -104059,7 +104059,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -104099,8 +104099,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -104925,8 +104925,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -104947,8 +104947,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -105051,8 +105051,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -105275,8 +105275,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -105320,8 +105320,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -105369,8 +105369,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -105394,8 +105394,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -105606,7 +105606,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -105646,8 +105646,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -106472,8 +106472,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -106494,8 +106494,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -106598,8 +106598,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -106822,8 +106822,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -106867,8 +106867,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -106916,8 +106916,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -106941,8 +106941,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -107153,7 +107153,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -107193,8 +107193,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -108019,8 +108019,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -108041,8 +108041,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -108145,8 +108145,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -108369,8 +108369,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -108414,8 +108414,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -108463,8 +108463,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -108488,8 +108488,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -108700,7 +108700,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -108740,8 +108740,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -109566,8 +109566,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -109588,8 +109588,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -109692,8 +109692,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -109916,8 +109916,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -109961,8 +109961,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -110010,8 +110010,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -110035,8 +110035,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -110247,7 +110247,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -110287,8 +110287,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -111113,8 +111113,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -111135,8 +111135,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -111239,8 +111239,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -111463,8 +111463,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -111508,8 +111508,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -111557,8 +111557,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -111582,8 +111582,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -111794,7 +111794,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -111834,8 +111834,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -112660,8 +112660,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -112682,8 +112682,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -112786,8 +112786,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -113010,8 +113010,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -113055,8 +113055,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -113104,8 +113104,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -113129,8 +113129,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -113341,7 +113341,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -113381,8 +113381,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -114207,8 +114207,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -114229,8 +114229,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -114333,8 +114333,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -114557,8 +114557,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -114602,8 +114602,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -114651,8 +114651,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -114676,8 +114676,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -114888,7 +114888,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -114928,8 +114928,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -115754,8 +115754,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -115776,8 +115776,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -115880,8 +115880,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -116104,8 +116104,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -116149,8 +116149,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -116198,8 +116198,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -116223,8 +116223,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -116435,7 +116435,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -116475,8 +116475,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -117301,8 +117301,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -117323,8 +117323,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -117427,8 +117427,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -117651,8 +117651,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -117696,8 +117696,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -117745,8 +117745,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -117770,8 +117770,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -117982,7 +117982,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -118022,8 +118022,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -118848,8 +118848,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -118870,8 +118870,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -118974,8 +118974,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -119198,8 +119198,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -119243,8 +119243,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -119292,8 +119292,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -119317,8 +119317,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -119529,7 +119529,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -119569,8 +119569,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -120395,8 +120395,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -120417,8 +120417,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -120521,8 +120521,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -120745,8 +120745,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -120790,8 +120790,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -120839,8 +120839,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -120864,8 +120864,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -121076,7 +121076,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -121116,8 +121116,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -121942,8 +121942,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -121964,8 +121964,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -122068,8 +122068,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -122292,8 +122292,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -122337,8 +122337,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -122386,8 +122386,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -122411,8 +122411,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -122623,7 +122623,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -122663,8 +122663,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -123489,8 +123489,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -123511,8 +123511,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -123615,8 +123615,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -123839,8 +123839,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -123884,8 +123884,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -123933,8 +123933,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -123958,8 +123958,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -124170,7 +124170,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -124210,8 +124210,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -125036,8 +125036,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -125058,8 +125058,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -125162,8 +125162,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -125386,8 +125386,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -125431,8 +125431,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -125480,8 +125480,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -125505,8 +125505,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -125717,7 +125717,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -125757,8 +125757,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -126583,8 +126583,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -126605,8 +126605,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -126709,8 +126709,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -126933,8 +126933,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -126978,8 +126978,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -127027,8 +127027,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -127052,8 +127052,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -127264,7 +127264,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -127304,8 +127304,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -128130,8 +128130,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -128152,8 +128152,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -128256,8 +128256,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -128480,8 +128480,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -128525,8 +128525,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -128574,8 +128574,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -128599,8 +128599,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -128811,7 +128811,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -128851,8 +128851,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -129677,8 +129677,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -129699,8 +129699,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -129803,8 +129803,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -130027,8 +130027,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -130072,8 +130072,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -130121,8 +130121,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -130146,8 +130146,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -130358,7 +130358,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -130398,8 +130398,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -131224,8 +131224,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -131246,8 +131246,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -131350,8 +131350,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -131574,8 +131574,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -131619,8 +131619,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -131668,8 +131668,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -131693,8 +131693,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -131905,7 +131905,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -131945,8 +131945,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -132771,8 +132771,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -132793,8 +132793,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -132897,8 +132897,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -133121,8 +133121,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -133166,8 +133166,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -133215,8 +133215,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -133240,8 +133240,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -133452,7 +133452,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -133492,8 +133492,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -134318,8 +134318,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -134340,8 +134340,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -134444,8 +134444,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -134668,8 +134668,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -134713,8 +134713,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -134762,8 +134762,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -134787,8 +134787,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -134999,7 +134999,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -135039,8 +135039,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -135865,8 +135865,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -135887,8 +135887,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -135991,8 +135991,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -136215,8 +136215,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -136260,8 +136260,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -136309,8 +136309,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -136334,8 +136334,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -136546,7 +136546,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -136586,8 +136586,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -137412,8 +137412,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -137434,8 +137434,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -137538,8 +137538,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -137762,8 +137762,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -137807,8 +137807,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -137856,8 +137856,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -137881,8 +137881,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -138093,7 +138093,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -138133,8 +138133,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -138959,8 +138959,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -138981,8 +138981,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -139085,8 +139085,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -139309,8 +139309,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -139354,8 +139354,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -139403,8 +139403,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -139428,8 +139428,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -139640,7 +139640,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -139680,8 +139680,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -140506,8 +140506,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -140528,8 +140528,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -140632,8 +140632,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -140856,8 +140856,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -140901,8 +140901,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -140950,8 +140950,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -140975,8 +140975,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -141187,7 +141187,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -141227,8 +141227,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -142053,8 +142053,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -142075,8 +142075,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -142179,8 +142179,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -142403,8 +142403,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -142448,8 +142448,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -142497,8 +142497,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -142522,8 +142522,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -142734,7 +142734,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -142774,8 +142774,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -143600,8 +143600,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -143622,8 +143622,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -143726,8 +143726,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -143950,8 +143950,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -143995,8 +143995,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -144044,8 +144044,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -144069,8 +144069,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -144281,7 +144281,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -144321,8 +144321,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -145147,8 +145147,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -145169,8 +145169,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -145273,8 +145273,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -145497,8 +145497,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -145542,8 +145542,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -145591,8 +145591,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -145616,8 +145616,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -145828,7 +145828,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -145868,8 +145868,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -146694,8 +146694,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -146716,8 +146716,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -146820,8 +146820,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -147044,8 +147044,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -147089,8 +147089,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -147138,8 +147138,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -147163,8 +147163,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -147375,7 +147375,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -147415,8 +147415,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -148241,8 +148241,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -148263,8 +148263,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -148367,8 +148367,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -148591,8 +148591,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -148636,8 +148636,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -148685,8 +148685,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -148710,8 +148710,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -148922,7 +148922,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -148962,8 +148962,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -149788,8 +149788,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -149810,8 +149810,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -149914,8 +149914,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -150138,8 +150138,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -150183,8 +150183,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -150232,8 +150232,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -150257,8 +150257,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -150469,7 +150469,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -150509,8 +150509,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -151335,8 +151335,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -151357,8 +151357,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -151461,8 +151461,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -151685,8 +151685,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -151730,8 +151730,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -151779,8 +151779,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -151804,8 +151804,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -152016,7 +152016,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -152056,8 +152056,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -152882,8 +152882,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -152904,8 +152904,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -153008,8 +153008,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -153232,8 +153232,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -153277,8 +153277,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -153326,8 +153326,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -153351,8 +153351,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -153563,7 +153563,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -153603,8 +153603,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -154429,8 +154429,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -154451,8 +154451,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -154555,8 +154555,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -154779,8 +154779,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -154824,8 +154824,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -154873,8 +154873,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -154898,8 +154898,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -155110,7 +155110,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -155150,8 +155150,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -155976,8 +155976,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -155998,8 +155998,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -156102,8 +156102,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -156326,8 +156326,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -156371,8 +156371,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -156420,8 +156420,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -156445,8 +156445,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -156657,7 +156657,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -156697,8 +156697,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -157523,8 +157523,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -157545,8 +157545,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -157649,8 +157649,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -157873,8 +157873,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -157918,8 +157918,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -157967,8 +157967,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -157992,8 +157992,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -158204,7 +158204,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -158244,8 +158244,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -159070,8 +159070,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -159092,8 +159092,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -159196,8 +159196,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -159420,8 +159420,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -159465,8 +159465,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -159514,8 +159514,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -159539,8 +159539,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -159751,7 +159751,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -159791,8 +159791,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -160617,8 +160617,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -160639,8 +160639,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -160743,8 +160743,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -160967,8 +160967,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -161012,8 +161012,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -161061,8 +161061,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -161086,8 +161086,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -161298,7 +161298,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -161338,8 +161338,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -162164,8 +162164,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -162186,8 +162186,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -162290,8 +162290,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -162514,8 +162514,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -162559,8 +162559,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -162608,8 +162608,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -162633,8 +162633,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -162845,7 +162845,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -162885,8 +162885,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -163711,8 +163711,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -163733,8 +163733,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -163837,8 +163837,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -164061,8 +164061,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -164106,8 +164106,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -164155,8 +164155,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -164180,8 +164180,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -164392,7 +164392,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -164432,8 +164432,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -165258,8 +165258,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -165280,8 +165280,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -165384,8 +165384,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -165608,8 +165608,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -165653,8 +165653,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -165702,8 +165702,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -165727,8 +165727,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -165939,7 +165939,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -165979,8 +165979,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -166805,8 +166805,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -166827,8 +166827,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -166931,8 +166931,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -167155,8 +167155,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -167200,8 +167200,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -167249,8 +167249,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -167274,8 +167274,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -167486,7 +167486,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -167526,8 +167526,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -168352,8 +168352,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -168374,8 +168374,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -168478,8 +168478,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -168702,8 +168702,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -168747,8 +168747,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -168796,8 +168796,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -168821,8 +168821,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -169033,7 +169033,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -169073,8 +169073,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -169899,8 +169899,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -169921,8 +169921,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -170025,8 +170025,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -170249,8 +170249,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -170294,8 +170294,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -170343,8 +170343,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -170368,8 +170368,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -170580,7 +170580,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -170620,8 +170620,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -171446,8 +171446,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -171468,8 +171468,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -171572,8 +171572,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -171796,8 +171796,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -171841,8 +171841,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -171890,8 +171890,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -171915,8 +171915,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -172127,7 +172127,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -172167,8 +172167,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -172993,8 +172993,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -173015,8 +173015,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -173119,8 +173119,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -173343,8 +173343,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -173388,8 +173388,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -173437,8 +173437,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -173462,8 +173462,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -173674,7 +173674,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -173714,8 +173714,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -174540,8 +174540,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -174562,8 +174562,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -174666,8 +174666,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -174890,8 +174890,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -174935,8 +174935,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -174984,8 +174984,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -175009,8 +175009,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -175221,7 +175221,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -175261,8 +175261,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -176087,8 +176087,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -176109,8 +176109,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -176213,8 +176213,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -176437,8 +176437,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -176482,8 +176482,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -176531,8 +176531,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -176556,8 +176556,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -176768,7 +176768,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -176808,8 +176808,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -177634,8 +177634,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -177656,8 +177656,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -177760,8 +177760,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -177984,8 +177984,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -178029,8 +178029,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -178078,8 +178078,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -178103,8 +178103,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -178315,7 +178315,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -178355,8 +178355,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -179181,8 +179181,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -179203,8 +179203,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -179307,8 +179307,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -179531,8 +179531,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -179576,8 +179576,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -179625,8 +179625,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -179650,8 +179650,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -179862,7 +179862,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -179902,8 +179902,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -180728,8 +180728,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -180750,8 +180750,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -180854,8 +180854,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -181078,8 +181078,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -181123,8 +181123,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -181172,8 +181172,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -181197,8 +181197,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -181409,7 +181409,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -181449,8 +181449,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -182275,8 +182275,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -182297,8 +182297,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -182401,8 +182401,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -182625,8 +182625,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -182670,8 +182670,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -182719,8 +182719,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -182744,8 +182744,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -182956,7 +182956,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -182996,8 +182996,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -183822,8 +183822,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -183844,8 +183844,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -183948,8 +183948,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -184172,8 +184172,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -184217,8 +184217,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -184266,8 +184266,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -184291,8 +184291,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -184503,7 +184503,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -184543,8 +184543,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -185369,8 +185369,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -185391,8 +185391,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -185495,8 +185495,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -185719,8 +185719,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -185764,8 +185764,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -185813,8 +185813,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -185838,8 +185838,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -186050,7 +186050,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -186090,8 +186090,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -186916,8 +186916,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -186938,8 +186938,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -187042,8 +187042,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -187266,8 +187266,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -187311,8 +187311,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -187360,8 +187360,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -187385,8 +187385,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -187597,7 +187597,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -187637,8 +187637,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -188463,8 +188463,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -188485,8 +188485,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -188589,8 +188589,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -188813,8 +188813,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -188858,8 +188858,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -188907,8 +188907,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -188932,8 +188932,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -189144,7 +189144,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -189184,8 +189184,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -190010,8 +190010,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -190032,8 +190032,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -190136,8 +190136,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -190360,8 +190360,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -190405,8 +190405,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -190454,8 +190454,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -190479,8 +190479,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -190691,7 +190691,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -190731,8 +190731,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -191557,8 +191557,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -191579,8 +191579,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -191683,8 +191683,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -191907,8 +191907,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -191952,8 +191952,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -192001,8 +192001,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -192026,8 +192026,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -192238,7 +192238,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -192278,8 +192278,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -193104,8 +193104,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -193126,8 +193126,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -193230,8 +193230,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -193454,8 +193454,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -193499,8 +193499,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -193548,8 +193548,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -193573,8 +193573,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -193785,7 +193785,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -193825,8 +193825,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -194651,8 +194651,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -194673,8 +194673,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -194777,8 +194777,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -195001,8 +195001,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -195046,8 +195046,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -195095,8 +195095,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -195120,8 +195120,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -195332,7 +195332,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -195372,8 +195372,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -196198,8 +196198,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -196220,8 +196220,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -196324,8 +196324,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -196548,8 +196548,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -196593,8 +196593,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -196642,8 +196642,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -196667,8 +196667,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -196879,7 +196879,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -196919,8 +196919,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -197745,8 +197745,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -197767,8 +197767,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -197871,8 +197871,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -198095,8 +198095,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -198140,8 +198140,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -198189,8 +198189,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -198214,8 +198214,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -198426,7 +198426,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -198466,8 +198466,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -199292,8 +199292,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -199314,8 +199314,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -199418,8 +199418,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -199642,8 +199642,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -199687,8 +199687,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -199736,8 +199736,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -199761,8 +199761,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -199973,7 +199973,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -200013,8 +200013,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -200839,8 +200839,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -200861,8 +200861,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -200965,8 +200965,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -201189,8 +201189,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -201234,8 +201234,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -201283,8 +201283,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -201308,8 +201308,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -201520,7 +201520,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -201560,8 +201560,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -202386,8 +202386,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -202408,8 +202408,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -202512,8 +202512,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -202736,8 +202736,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -202781,8 +202781,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -202830,8 +202830,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -202855,8 +202855,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -203067,7 +203067,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -203107,8 +203107,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -203933,8 +203933,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -203955,8 +203955,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -204059,8 +204059,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -204283,8 +204283,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -204328,8 +204328,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -204377,8 +204377,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -204402,8 +204402,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -204614,7 +204614,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -204654,8 +204654,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -205480,8 +205480,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -205502,8 +205502,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -205606,8 +205606,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -205830,8 +205830,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -205875,8 +205875,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -205924,8 +205924,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -205949,8 +205949,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -206161,7 +206161,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -206201,8 +206201,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -207027,8 +207027,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -207049,8 +207049,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -207153,8 +207153,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -207377,8 +207377,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -207422,8 +207422,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -207471,8 +207471,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -207496,8 +207496,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -207708,7 +207708,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -207748,8 +207748,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -208574,8 +208574,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -208596,8 +208596,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -208700,8 +208700,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -208924,8 +208924,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -208969,8 +208969,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -209018,8 +209018,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -209043,8 +209043,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -209255,7 +209255,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -209295,8 +209295,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -210121,8 +210121,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -210143,8 +210143,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -210247,8 +210247,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -210471,8 +210471,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -210516,8 +210516,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -210565,8 +210565,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -210590,8 +210590,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -210802,7 +210802,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -210842,8 +210842,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -211668,8 +211668,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -211690,8 +211690,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -211794,8 +211794,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -212018,8 +212018,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -212063,8 +212063,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -212112,8 +212112,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -212137,8 +212137,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -212349,7 +212349,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -212389,8 +212389,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -213215,8 +213215,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -213237,8 +213237,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -213341,8 +213341,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -213565,8 +213565,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -213610,8 +213610,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -213659,8 +213659,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -213684,8 +213684,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -213896,7 +213896,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -213936,8 +213936,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -214762,8 +214762,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -214784,8 +214784,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -214888,8 +214888,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -215112,8 +215112,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -215157,8 +215157,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -215206,8 +215206,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -215231,8 +215231,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -215443,7 +215443,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -215483,8 +215483,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -216309,8 +216309,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -216331,8 +216331,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -216435,8 +216435,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -216659,8 +216659,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -216704,8 +216704,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -216753,8 +216753,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -216778,8 +216778,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -216990,7 +216990,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -217030,8 +217030,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -217856,8 +217856,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -217878,8 +217878,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -217982,8 +217982,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -218206,8 +218206,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -218251,8 +218251,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -218300,8 +218300,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -218325,8 +218325,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -218537,7 +218537,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -218577,8 +218577,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -219403,8 +219403,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -219425,8 +219425,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -219529,8 +219529,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -219753,8 +219753,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -219798,8 +219798,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -219847,8 +219847,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -219872,8 +219872,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -220084,7 +220084,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -220124,8 +220124,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -220950,8 +220950,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -220972,8 +220972,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -221076,8 +221076,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -221300,8 +221300,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -221345,8 +221345,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -221394,8 +221394,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -221419,8 +221419,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -221631,7 +221631,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -221671,8 +221671,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -222497,8 +222497,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -222519,8 +222519,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -222623,8 +222623,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -222847,8 +222847,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -222892,8 +222892,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -222941,8 +222941,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -222966,8 +222966,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -223178,7 +223178,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -223218,8 +223218,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -224044,8 +224044,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -224066,8 +224066,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -224170,8 +224170,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -224394,8 +224394,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -224439,8 +224439,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -224488,8 +224488,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -224513,8 +224513,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -224725,7 +224725,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -224765,8 +224765,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -225591,8 +225591,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -225613,8 +225613,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -225717,8 +225717,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -225941,8 +225941,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -225986,8 +225986,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -226035,8 +226035,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -226060,8 +226060,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -226272,7 +226272,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -226312,8 +226312,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -227138,8 +227138,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -227160,8 +227160,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -227264,8 +227264,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -227488,8 +227488,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -227533,8 +227533,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -227582,8 +227582,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -227607,8 +227607,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -227819,7 +227819,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -227859,8 +227859,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -228685,8 +228685,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -228707,8 +228707,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -228811,8 +228811,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -229035,8 +229035,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -229080,8 +229080,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -229129,8 +229129,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -229154,8 +229154,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -229366,7 +229366,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -229406,8 +229406,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -230232,8 +230232,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -230254,8 +230254,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -230358,8 +230358,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -230582,8 +230582,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -230627,8 +230627,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -230676,8 +230676,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -230701,8 +230701,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -230913,7 +230913,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -230953,8 +230953,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -231779,8 +231779,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -231801,8 +231801,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -231905,8 +231905,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -232129,8 +232129,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -232174,8 +232174,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -232223,8 +232223,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -232248,8 +232248,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -232460,7 +232460,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -232500,8 +232500,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -233326,8 +233326,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -233348,8 +233348,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -233452,8 +233452,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -233676,8 +233676,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -233721,8 +233721,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -233770,8 +233770,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -233795,8 +233795,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -234007,7 +234007,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -234047,8 +234047,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -234873,8 +234873,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -234895,8 +234895,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -234999,8 +234999,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -235223,8 +235223,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -235268,8 +235268,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -235317,8 +235317,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -235342,8 +235342,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -235554,7 +235554,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -235594,8 +235594,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -236420,8 +236420,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -236442,8 +236442,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -236546,8 +236546,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -236770,8 +236770,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -236815,8 +236815,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -236864,8 +236864,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -236889,8 +236889,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -237101,7 +237101,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -237141,8 +237141,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -237967,8 +237967,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -237989,8 +237989,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -238093,8 +238093,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -238317,8 +238317,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -238362,8 +238362,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -238411,8 +238411,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -238436,8 +238436,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -238648,7 +238648,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -238688,8 +238688,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -239514,8 +239514,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -239536,8 +239536,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -239640,8 +239640,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -239864,8 +239864,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -239909,8 +239909,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -239958,8 +239958,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -239983,8 +239983,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -240195,7 +240195,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -240235,8 +240235,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -241061,8 +241061,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -241083,8 +241083,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -241187,8 +241187,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -241411,8 +241411,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -241456,8 +241456,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -241505,8 +241505,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -241530,8 +241530,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -241742,7 +241742,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -241782,8 +241782,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -242608,8 +242608,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -242630,8 +242630,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -242734,8 +242734,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -242958,8 +242958,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -243003,8 +243003,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -243052,8 +243052,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -243077,8 +243077,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -243289,7 +243289,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -243329,8 +243329,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -244155,8 +244155,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -244177,8 +244177,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -244281,8 +244281,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -244505,8 +244505,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -244550,8 +244550,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -244599,8 +244599,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -244624,8 +244624,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -244836,7 +244836,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -244876,8 +244876,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -245702,8 +245702,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -245724,8 +245724,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -245828,8 +245828,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -246052,8 +246052,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -246097,8 +246097,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -246146,8 +246146,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -246171,8 +246171,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -246383,7 +246383,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -246423,8 +246423,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -247249,8 +247249,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -247271,8 +247271,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -247375,8 +247375,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -247599,8 +247599,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -247644,8 +247644,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -247693,8 +247693,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -247718,8 +247718,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -247930,7 +247930,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -247970,8 +247970,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -248796,8 +248796,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -248818,8 +248818,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -248922,8 +248922,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -249146,8 +249146,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -249191,8 +249191,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -249240,8 +249240,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -249265,8 +249265,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -249477,7 +249477,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -249517,8 +249517,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -250343,8 +250343,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -250365,8 +250365,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -250469,8 +250469,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -250693,8 +250693,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -250738,8 +250738,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -250787,8 +250787,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -250812,8 +250812,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -251024,7 +251024,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -251064,8 +251064,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -251890,8 +251890,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -251912,8 +251912,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -252016,8 +252016,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -252240,8 +252240,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -252285,8 +252285,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -252334,8 +252334,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -252359,8 +252359,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -252571,7 +252571,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -252611,8 +252611,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -253437,8 +253437,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -253459,8 +253459,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -253563,8 +253563,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -253787,8 +253787,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -253832,8 +253832,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -253881,8 +253881,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -253906,8 +253906,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -254118,7 +254118,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -254158,8 +254158,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -254984,8 +254984,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -255006,8 +255006,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -255110,8 +255110,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -255334,8 +255334,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -255379,8 +255379,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -255428,8 +255428,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -255453,8 +255453,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -255665,7 +255665,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -255705,8 +255705,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -256531,8 +256531,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -256553,8 +256553,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -256657,8 +256657,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -256881,8 +256881,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -256926,8 +256926,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -256975,8 +256975,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -257000,8 +257000,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -257212,7 +257212,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -257252,8 +257252,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -258078,8 +258078,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -258100,8 +258100,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -258204,8 +258204,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -258428,8 +258428,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -258473,8 +258473,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -258522,8 +258522,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -258547,8 +258547,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -258759,7 +258759,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -258799,8 +258799,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -259625,8 +259625,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -259647,8 +259647,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -259751,8 +259751,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -259975,8 +259975,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -260020,8 +260020,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -260069,8 +260069,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -260094,8 +260094,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -260306,7 +260306,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -260346,8 +260346,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -261172,8 +261172,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -261194,8 +261194,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -261298,8 +261298,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -261522,8 +261522,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -261567,8 +261567,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -261616,8 +261616,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -261641,8 +261641,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -261853,7 +261853,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -261893,8 +261893,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -262719,8 +262719,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -262741,8 +262741,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -262845,8 +262845,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -263069,8 +263069,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -263114,8 +263114,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -263163,8 +263163,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -263188,8 +263188,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -263400,7 +263400,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -263440,8 +263440,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -264266,8 +264266,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -264288,8 +264288,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -264392,8 +264392,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -264616,8 +264616,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -264661,8 +264661,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -264710,8 +264710,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -264735,8 +264735,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -264947,7 +264947,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -264987,8 +264987,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -265813,8 +265813,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -265835,8 +265835,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -265939,8 +265939,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -266163,8 +266163,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -266208,8 +266208,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -266257,8 +266257,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -266282,8 +266282,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -266494,7 +266494,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -266534,8 +266534,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -267360,8 +267360,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -267382,8 +267382,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -267486,8 +267486,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -267710,8 +267710,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -267755,8 +267755,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -267804,8 +267804,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -267829,8 +267829,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -268041,7 +268041,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -268081,8 +268081,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -268907,8 +268907,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -268929,8 +268929,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -269033,8 +269033,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -269257,8 +269257,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -269302,8 +269302,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -269351,8 +269351,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -269376,8 +269376,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -269588,7 +269588,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -269628,8 +269628,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -270454,8 +270454,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -270476,8 +270476,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -270580,8 +270580,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -270804,8 +270804,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -270849,8 +270849,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -270898,8 +270898,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -270923,8 +270923,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -271135,7 +271135,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -271175,8 +271175,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -272001,8 +272001,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -272023,8 +272023,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -272127,8 +272127,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -272351,8 +272351,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -272396,8 +272396,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -272445,8 +272445,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -272470,8 +272470,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -272682,7 +272682,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -272722,8 +272722,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -273548,8 +273548,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -273570,8 +273570,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -273674,8 +273674,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -273898,8 +273898,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -273943,8 +273943,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -273992,8 +273992,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -274017,8 +274017,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -274229,7 +274229,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -274269,8 +274269,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -275095,8 +275095,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -275117,8 +275117,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -275221,8 +275221,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -275445,8 +275445,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -275490,8 +275490,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -275539,8 +275539,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -275564,8 +275564,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -275776,7 +275776,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -275816,8 +275816,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -276642,8 +276642,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -276664,8 +276664,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -276768,8 +276768,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -276992,8 +276992,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -277037,8 +277037,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -277086,8 +277086,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -277111,8 +277111,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -277323,7 +277323,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -277363,8 +277363,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -278189,8 +278189,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -278211,8 +278211,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -278315,8 +278315,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -278539,8 +278539,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -278584,8 +278584,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -278633,8 +278633,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -278658,8 +278658,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -278870,7 +278870,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -278910,8 +278910,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -279736,8 +279736,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -279758,8 +279758,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -279862,8 +279862,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -280086,8 +280086,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -280131,8 +280131,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -280180,8 +280180,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -280205,8 +280205,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -280417,7 +280417,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -280457,8 +280457,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -281283,8 +281283,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -281305,8 +281305,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -281409,8 +281409,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -281633,8 +281633,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -281678,8 +281678,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -281727,8 +281727,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -281752,8 +281752,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -281964,7 +281964,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -282004,8 +282004,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -282830,8 +282830,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -282852,8 +282852,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -282956,8 +282956,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -283180,8 +283180,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -283225,8 +283225,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -283274,8 +283274,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -283299,8 +283299,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -283511,7 +283511,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -283551,8 +283551,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -284377,8 +284377,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -284399,8 +284399,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -284503,8 +284503,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -284727,8 +284727,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -284772,8 +284772,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -284821,8 +284821,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -284846,8 +284846,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -285058,7 +285058,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -285098,8 +285098,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -285924,8 +285924,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -285946,8 +285946,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -286050,8 +286050,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -286274,8 +286274,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -286319,8 +286319,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -286368,8 +286368,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -286393,8 +286393,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -286605,7 +286605,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -286645,8 +286645,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -287471,8 +287471,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -287493,8 +287493,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -287597,8 +287597,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -287821,8 +287821,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -287866,8 +287866,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -287915,8 +287915,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -287940,8 +287940,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -288152,7 +288152,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -288192,8 +288192,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -289018,8 +289018,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -289040,8 +289040,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -289144,8 +289144,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -289368,8 +289368,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -289413,8 +289413,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -289462,8 +289462,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -289487,8 +289487,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -289699,7 +289699,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -289739,8 +289739,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -290565,8 +290565,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -290587,8 +290587,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -290691,8 +290691,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -290915,8 +290915,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -290960,8 +290960,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -291009,8 +291009,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -291034,8 +291034,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -291246,7 +291246,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -291286,8 +291286,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -292112,8 +292112,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -292134,8 +292134,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -292238,8 +292238,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -292462,8 +292462,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -292507,8 +292507,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -292556,8 +292556,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -292581,8 +292581,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -292793,7 +292793,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -292833,8 +292833,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -293659,8 +293659,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -293681,8 +293681,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -293785,8 +293785,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -294009,8 +294009,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -294054,8 +294054,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -294103,8 +294103,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -294128,8 +294128,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -294340,7 +294340,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -294380,8 +294380,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -295206,8 +295206,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -295228,8 +295228,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -295332,8 +295332,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -295556,8 +295556,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -295601,8 +295601,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -295650,8 +295650,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -295675,8 +295675,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -295887,7 +295887,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -295927,8 +295927,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -296753,8 +296753,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -296775,8 +296775,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -296879,8 +296879,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -297103,8 +297103,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -297148,8 +297148,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -297197,8 +297197,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -297222,8 +297222,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -297434,7 +297434,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -297474,8 +297474,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -298300,8 +298300,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -298322,8 +298322,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -298426,8 +298426,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -298650,8 +298650,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -298695,8 +298695,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -298744,8 +298744,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -298769,8 +298769,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -298981,7 +298981,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -299021,8 +299021,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -299847,8 +299847,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -299869,8 +299869,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -299973,8 +299973,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -300197,8 +300197,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -300242,8 +300242,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -300291,8 +300291,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -300316,8 +300316,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -300528,7 +300528,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -300568,8 +300568,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -301394,8 +301394,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -301416,8 +301416,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -301520,8 +301520,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -301744,8 +301744,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -301789,8 +301789,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -301838,8 +301838,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -301863,8 +301863,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -302075,7 +302075,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -302115,8 +302115,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -302941,8 +302941,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -302963,8 +302963,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -303067,8 +303067,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -303291,8 +303291,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -303336,8 +303336,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -303385,8 +303385,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -303410,8 +303410,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -303622,7 +303622,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -303662,8 +303662,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -304488,8 +304488,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -304510,8 +304510,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -304614,8 +304614,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -304838,8 +304838,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -304883,8 +304883,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -304932,8 +304932,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -304957,8 +304957,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -305169,7 +305169,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -305209,8 +305209,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -306035,8 +306035,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -306057,8 +306057,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -306161,8 +306161,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -306385,8 +306385,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -306430,8 +306430,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -306479,8 +306479,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -306504,8 +306504,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -306716,7 +306716,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -306756,8 +306756,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -307582,8 +307582,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -307604,8 +307604,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -307708,8 +307708,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -307932,8 +307932,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -307977,8 +307977,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -308026,8 +308026,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -308051,8 +308051,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -308263,7 +308263,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -308303,8 +308303,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -309129,8 +309129,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -309151,8 +309151,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -309255,8 +309255,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -309479,8 +309479,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -309524,8 +309524,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -309573,8 +309573,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -309598,8 +309598,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -309810,7 +309810,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -309850,8 +309850,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -310676,8 +310676,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -310698,8 +310698,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -310802,8 +310802,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -311026,8 +311026,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -311071,8 +311071,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -311120,8 +311120,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -311145,8 +311145,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -311357,7 +311357,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -311397,8 +311397,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -312223,8 +312223,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -312245,8 +312245,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -312349,8 +312349,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -312573,8 +312573,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -312618,8 +312618,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -312667,8 +312667,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -312692,8 +312692,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -312904,7 +312904,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -312944,8 +312944,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -313770,8 +313770,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -313792,8 +313792,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -313896,8 +313896,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -314120,8 +314120,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -314165,8 +314165,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -314214,8 +314214,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -314239,8 +314239,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -314451,7 +314451,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -314491,8 +314491,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -315317,8 +315317,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -315339,8 +315339,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -315443,8 +315443,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -315667,8 +315667,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -315712,8 +315712,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -315761,8 +315761,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -315786,8 +315786,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -315998,7 +315998,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -316038,8 +316038,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -316864,8 +316864,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -316886,8 +316886,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -316990,8 +316990,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -317214,8 +317214,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -317259,8 +317259,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -317308,8 +317308,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -317333,8 +317333,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -317545,7 +317545,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -317585,8 +317585,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -318411,8 +318411,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -318433,8 +318433,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -318537,8 +318537,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -318761,8 +318761,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -318806,8 +318806,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -318855,8 +318855,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -318880,8 +318880,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -319092,7 +319092,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -319132,8 +319132,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -319958,8 +319958,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -319980,8 +319980,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -320084,8 +320084,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -320308,8 +320308,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -320353,8 +320353,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -320402,8 +320402,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -320427,8 +320427,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -320639,7 +320639,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -320679,8 +320679,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -321505,8 +321505,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -321527,8 +321527,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -321631,8 +321631,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -321855,8 +321855,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -321900,8 +321900,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -321949,8 +321949,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -321974,8 +321974,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -322186,7 +322186,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -322226,8 +322226,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -323052,8 +323052,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -323074,8 +323074,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -323178,8 +323178,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -323402,8 +323402,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -323447,8 +323447,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -323496,8 +323496,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -323521,8 +323521,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -323733,7 +323733,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -323773,8 +323773,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -324599,8 +324599,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -324621,8 +324621,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -324725,8 +324725,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -324949,8 +324949,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -324994,8 +324994,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -325043,8 +325043,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -325068,8 +325068,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -325280,7 +325280,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -325320,8 +325320,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -326146,8 +326146,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -326168,8 +326168,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -326272,8 +326272,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -326496,8 +326496,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -326541,8 +326541,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -326590,8 +326590,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -326615,8 +326615,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -326827,7 +326827,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -326867,8 +326867,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -327693,8 +327693,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -327715,8 +327715,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -327819,8 +327819,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -328043,8 +328043,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -328088,8 +328088,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -328137,8 +328137,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -328162,8 +328162,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -328374,7 +328374,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -328414,8 +328414,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -329240,8 +329240,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -329262,8 +329262,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -329366,8 +329366,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -329590,8 +329590,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -329635,8 +329635,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -329684,8 +329684,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -329709,8 +329709,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -329921,7 +329921,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -329961,8 +329961,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -330787,8 +330787,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -330809,8 +330809,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -330913,8 +330913,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -331137,8 +331137,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -331182,8 +331182,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -331231,8 +331231,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -331256,8 +331256,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -331468,7 +331468,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -331508,8 +331508,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -332334,8 +332334,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -332356,8 +332356,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -332460,8 +332460,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -332684,8 +332684,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -332729,8 +332729,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -332778,8 +332778,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -332803,8 +332803,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -333015,7 +333015,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -333055,8 +333055,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -333881,8 +333881,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -333903,8 +333903,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -334007,8 +334007,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -334231,8 +334231,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -334276,8 +334276,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -334325,8 +334325,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -334350,8 +334350,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -334562,7 +334562,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -334602,8 +334602,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -335428,8 +335428,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -335450,8 +335450,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -335554,8 +335554,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -335778,8 +335778,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -335823,8 +335823,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -335872,8 +335872,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -335897,8 +335897,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -336109,7 +336109,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -336149,8 +336149,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -336975,8 +336975,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -336997,8 +336997,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -337101,8 +337101,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -337325,8 +337325,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -337370,8 +337370,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -337419,8 +337419,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -337444,8 +337444,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -337656,7 +337656,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -337696,8 +337696,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -338522,8 +338522,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -338544,8 +338544,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -338648,8 +338648,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -338872,8 +338872,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -338917,8 +338917,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -338966,8 +338966,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -338991,8 +338991,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -339203,7 +339203,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -339243,8 +339243,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -340069,8 +340069,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -340091,8 +340091,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -340195,8 +340195,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -340419,8 +340419,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -340464,8 +340464,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -340513,8 +340513,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -340538,8 +340538,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -340750,7 +340750,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -340790,8 +340790,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -341616,8 +341616,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -341638,8 +341638,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -341742,8 +341742,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -341966,8 +341966,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -342011,8 +342011,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -342060,8 +342060,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -342085,8 +342085,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -342297,7 +342297,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -342337,8 +342337,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -343163,8 +343163,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -343185,8 +343185,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -343289,8 +343289,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -343513,8 +343513,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -343558,8 +343558,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -343607,8 +343607,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -343632,8 +343632,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -343844,7 +343844,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -343884,8 +343884,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -344710,8 +344710,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -344732,8 +344732,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -344836,8 +344836,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -345060,8 +345060,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -345105,8 +345105,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -345154,8 +345154,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -345179,8 +345179,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -345391,7 +345391,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -345431,8 +345431,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -346257,8 +346257,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -346279,8 +346279,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -346383,8 +346383,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -346607,8 +346607,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -346652,8 +346652,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -346701,8 +346701,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -346726,8 +346726,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -346938,7 +346938,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -346978,8 +346978,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -347804,8 +347804,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -347826,8 +347826,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -347930,8 +347930,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -348154,8 +348154,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -348199,8 +348199,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -348248,8 +348248,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -348273,8 +348273,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -348485,7 +348485,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -348525,8 +348525,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -349351,8 +349351,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -349373,8 +349373,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -349477,8 +349477,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -349701,8 +349701,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -349746,8 +349746,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -349795,8 +349795,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -349820,8 +349820,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -350032,7 +350032,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -350072,8 +350072,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -350898,8 +350898,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -350920,8 +350920,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -351024,8 +351024,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -351248,8 +351248,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -351293,8 +351293,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -351342,8 +351342,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -351367,8 +351367,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -351579,7 +351579,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -351619,8 +351619,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -352445,8 +352445,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -352467,8 +352467,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -352571,8 +352571,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -352795,8 +352795,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -352840,8 +352840,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -352889,8 +352889,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -352914,8 +352914,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -353126,7 +353126,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -353166,8 +353166,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -353992,8 +353992,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -354014,8 +354014,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -354118,8 +354118,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -354342,8 +354342,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -354387,8 +354387,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -354436,8 +354436,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -354461,8 +354461,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -354673,7 +354673,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -354713,8 +354713,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -355539,8 +355539,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -355561,8 +355561,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -355665,8 +355665,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -355889,8 +355889,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -355934,8 +355934,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -355983,8 +355983,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -356008,8 +356008,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -356220,7 +356220,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -356260,8 +356260,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -357086,8 +357086,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -357108,8 +357108,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -357212,8 +357212,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -357436,8 +357436,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -357481,8 +357481,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -357530,8 +357530,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -357555,8 +357555,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -357767,7 +357767,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -357807,8 +357807,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -358633,8 +358633,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -358655,8 +358655,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -358759,8 +358759,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -358983,8 +358983,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -359028,8 +359028,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -359077,8 +359077,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -359102,8 +359102,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -359314,7 +359314,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -359354,8 +359354,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -360180,8 +360180,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -360202,8 +360202,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -360306,8 +360306,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -360530,8 +360530,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -360575,8 +360575,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -360624,8 +360624,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -360649,8 +360649,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -360861,7 +360861,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -360901,8 +360901,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -361727,8 +361727,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -361749,8 +361749,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -361853,8 +361853,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -362077,8 +362077,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -362122,8 +362122,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -362171,8 +362171,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -362196,8 +362196,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -362408,7 +362408,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -362448,8 +362448,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -363274,8 +363274,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -363296,8 +363296,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -363400,8 +363400,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -363624,8 +363624,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -363669,8 +363669,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -363718,8 +363718,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -363743,8 +363743,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -363955,7 +363955,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -363995,8 +363995,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -364821,8 +364821,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -364843,8 +364843,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -364947,8 +364947,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -365171,8 +365171,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -365216,8 +365216,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -365265,8 +365265,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -365290,8 +365290,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -365502,7 +365502,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -365542,8 +365542,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -366368,8 +366368,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -366390,8 +366390,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -366494,8 +366494,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -366718,8 +366718,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -366763,8 +366763,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -366812,8 +366812,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -366837,8 +366837,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -367049,7 +367049,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -367089,8 +367089,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -367915,8 +367915,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -367937,8 +367937,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -368041,8 +368041,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -368265,8 +368265,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -368310,8 +368310,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -368359,8 +368359,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -368384,8 +368384,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -368596,7 +368596,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -368636,8 +368636,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -369462,8 +369462,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -369484,8 +369484,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -369588,8 +369588,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -369812,8 +369812,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -369857,8 +369857,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -369906,8 +369906,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -369931,8 +369931,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -370143,7 +370143,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -370183,8 +370183,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -371009,8 +371009,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -371031,8 +371031,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -371135,8 +371135,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -371359,8 +371359,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -371404,8 +371404,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -371453,8 +371453,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -371478,8 +371478,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -371690,7 +371690,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -371730,8 +371730,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -372556,8 +372556,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -372578,8 +372578,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -372682,8 +372682,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -372906,8 +372906,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -372951,8 +372951,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -373000,8 +373000,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -373025,8 +373025,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -373237,7 +373237,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -373277,8 +373277,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -374103,8 +374103,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -374125,8 +374125,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -374229,8 +374229,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -374453,8 +374453,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -374498,8 +374498,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -374547,8 +374547,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -374572,8 +374572,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -374784,7 +374784,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -374824,8 +374824,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -375650,8 +375650,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -375672,8 +375672,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -375776,8 +375776,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -376000,8 +376000,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -376045,8 +376045,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -376094,8 +376094,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -376119,8 +376119,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -376331,7 +376331,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -376371,8 +376371,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -377197,8 +377197,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -377219,8 +377219,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -377323,8 +377323,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -377547,8 +377547,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -377592,8 +377592,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -377641,8 +377641,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -377666,8 +377666,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -377878,7 +377878,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -377918,8 +377918,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -378744,8 +378744,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -378766,8 +378766,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -378870,8 +378870,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -379094,8 +379094,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -379139,8 +379139,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -379188,8 +379188,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -379213,8 +379213,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -379425,7 +379425,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -379465,8 +379465,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -380291,8 +380291,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -380313,8 +380313,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -380417,8 +380417,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -380641,8 +380641,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -380686,8 +380686,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -380735,8 +380735,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -380760,8 +380760,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -380972,7 +380972,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -381012,8 +381012,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -381838,8 +381838,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -381860,8 +381860,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -381964,8 +381964,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -382188,8 +382188,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -382233,8 +382233,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -382282,8 +382282,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -382307,8 +382307,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -382519,7 +382519,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -382559,8 +382559,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -383385,8 +383385,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -383407,8 +383407,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -383511,8 +383511,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -383735,8 +383735,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -383780,8 +383780,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -383829,8 +383829,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -383854,8 +383854,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -384066,7 +384066,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -384106,8 +384106,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -384932,8 +384932,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -384954,8 +384954,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -385058,8 +385058,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -385282,8 +385282,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -385327,8 +385327,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -385376,8 +385376,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -385401,8 +385401,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -385613,7 +385613,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -385653,8 +385653,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -386479,8 +386479,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -386501,8 +386501,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -386605,8 +386605,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -386829,8 +386829,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -386874,8 +386874,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -386923,8 +386923,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -386948,8 +386948,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -387160,7 +387160,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -387200,8 +387200,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -388026,8 +388026,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -388048,8 +388048,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -388152,8 +388152,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -388376,8 +388376,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -388421,8 +388421,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -388470,8 +388470,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -388495,8 +388495,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -388707,7 +388707,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -388747,8 +388747,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -389573,8 +389573,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -389595,8 +389595,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -389699,8 +389699,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -389923,8 +389923,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -389968,8 +389968,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -390017,8 +390017,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -390042,8 +390042,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -390254,7 +390254,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -390294,8 +390294,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -391120,8 +391120,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -391142,8 +391142,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -391246,8 +391246,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -391470,8 +391470,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -391515,8 +391515,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -391564,8 +391564,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -391589,8 +391589,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -391801,7 +391801,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -391841,8 +391841,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -392667,8 +392667,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -392689,8 +392689,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -392793,8 +392793,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -393017,8 +393017,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -393062,8 +393062,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -393111,8 +393111,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -393136,8 +393136,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -393348,7 +393348,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -393388,8 +393388,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -394214,8 +394214,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -394236,8 +394236,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -394340,8 +394340,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -394564,8 +394564,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -394609,8 +394609,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -394658,8 +394658,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -394683,8 +394683,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -394895,7 +394895,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -394935,8 +394935,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -395761,8 +395761,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -395783,8 +395783,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -395887,8 +395887,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -396111,8 +396111,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -396156,8 +396156,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -396205,8 +396205,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -396230,8 +396230,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -396442,7 +396442,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -396482,8 +396482,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -397308,8 +397308,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -397330,8 +397330,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -397434,8 +397434,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -397658,8 +397658,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -397703,8 +397703,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -397752,8 +397752,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -397777,8 +397777,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -397989,7 +397989,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -398029,8 +398029,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -398855,8 +398855,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -398877,8 +398877,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -398981,8 +398981,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -399205,8 +399205,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -399250,8 +399250,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -399299,8 +399299,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -399324,8 +399324,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -399536,7 +399536,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -399576,8 +399576,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -400402,8 +400402,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -400424,8 +400424,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -400528,8 +400528,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -400752,8 +400752,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -400797,8 +400797,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -400846,8 +400846,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -400871,8 +400871,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -401083,7 +401083,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -401123,8 +401123,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -401949,8 +401949,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -401971,8 +401971,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -402075,8 +402075,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -402299,8 +402299,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -402344,8 +402344,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -402393,8 +402393,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -402418,8 +402418,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -402630,7 +402630,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -402670,8 +402670,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -403496,8 +403496,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -403518,8 +403518,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -403622,8 +403622,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -403846,8 +403846,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -403891,8 +403891,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -403940,8 +403940,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -403965,8 +403965,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -404177,7 +404177,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -404217,8 +404217,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -405043,8 +405043,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -405065,8 +405065,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -405169,8 +405169,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -405393,8 +405393,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -405438,8 +405438,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -405487,8 +405487,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -405512,8 +405512,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -405724,7 +405724,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -405764,8 +405764,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -406590,8 +406590,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -406612,8 +406612,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -406716,8 +406716,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -406940,8 +406940,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -406985,8 +406985,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -407034,8 +407034,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -407059,8 +407059,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -407271,7 +407271,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -407311,8 +407311,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -408137,8 +408137,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -408159,8 +408159,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -408263,8 +408263,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -408487,8 +408487,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -408532,8 +408532,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -408581,8 +408581,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -408606,8 +408606,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -408818,7 +408818,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -408858,8 +408858,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -409684,8 +409684,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -409706,8 +409706,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -409810,8 +409810,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -410034,8 +410034,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -410079,8 +410079,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -410128,8 +410128,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -410153,8 +410153,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -410365,7 +410365,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -410405,8 +410405,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -411231,8 +411231,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -411253,8 +411253,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -411357,8 +411357,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -411581,8 +411581,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -411626,8 +411626,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -411675,8 +411675,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -411700,8 +411700,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -411912,7 +411912,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -411952,8 +411952,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -412778,8 +412778,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -412800,8 +412800,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -412904,8 +412904,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -413128,8 +413128,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -413173,8 +413173,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -413222,8 +413222,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -413247,8 +413247,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -413459,7 +413459,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -413499,8 +413499,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -414325,8 +414325,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -414347,8 +414347,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -414451,8 +414451,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -414675,8 +414675,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -414720,8 +414720,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -414769,8 +414769,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -414794,8 +414794,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -415006,7 +415006,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -415046,8 +415046,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -415872,8 +415872,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -415894,8 +415894,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -415998,8 +415998,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -416222,8 +416222,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -416267,8 +416267,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -416316,8 +416316,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -416341,8 +416341,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -416553,7 +416553,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -416593,8 +416593,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -417419,8 +417419,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -417441,8 +417441,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -417545,8 +417545,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -417769,8 +417769,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -417814,8 +417814,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -417863,8 +417863,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -417888,8 +417888,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -418100,7 +418100,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -418140,8 +418140,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -418966,8 +418966,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -418988,8 +418988,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -419092,8 +419092,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -419316,8 +419316,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -419361,8 +419361,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -419410,8 +419410,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -419435,8 +419435,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -419647,7 +419647,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -419687,8 +419687,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -420513,8 +420513,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -420535,8 +420535,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -420639,8 +420639,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -420863,8 +420863,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -420908,8 +420908,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -420957,8 +420957,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -420982,8 +420982,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -421194,7 +421194,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -421234,8 +421234,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -422060,8 +422060,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -422082,8 +422082,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -422186,8 +422186,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -422410,8 +422410,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -422455,8 +422455,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -422504,8 +422504,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -422529,8 +422529,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -422741,7 +422741,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -422781,8 +422781,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -423607,8 +423607,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -423629,8 +423629,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -423733,8 +423733,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -423957,8 +423957,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -424002,8 +424002,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -424051,8 +424051,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -424076,8 +424076,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -424288,7 +424288,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -424328,8 +424328,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -425154,8 +425154,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -425176,8 +425176,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -425280,8 +425280,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -425504,8 +425504,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -425549,8 +425549,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -425598,8 +425598,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -425623,8 +425623,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -425835,7 +425835,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -425875,8 +425875,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -426701,8 +426701,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -426723,8 +426723,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -426827,8 +426827,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -427051,8 +427051,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -427096,8 +427096,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -427145,8 +427145,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -427170,8 +427170,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -427382,7 +427382,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -427422,8 +427422,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -428248,8 +428248,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -428270,8 +428270,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -428374,8 +428374,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -428598,8 +428598,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -428643,8 +428643,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -428692,8 +428692,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -428717,8 +428717,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -428929,7 +428929,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -428969,8 +428969,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -429795,8 +429795,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -429817,8 +429817,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -429921,8 +429921,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -430145,8 +430145,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -430190,8 +430190,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -430239,8 +430239,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -430264,8 +430264,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -430476,7 +430476,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -430516,8 +430516,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -431342,8 +431342,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -431364,8 +431364,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -431468,8 +431468,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -431692,8 +431692,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -431737,8 +431737,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -431786,8 +431786,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -431811,8 +431811,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -432023,7 +432023,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -432063,8 +432063,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -432889,8 +432889,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -432911,8 +432911,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -433015,8 +433015,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -433239,8 +433239,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -433284,8 +433284,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -433333,8 +433333,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -433358,8 +433358,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -433570,7 +433570,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -433610,8 +433610,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -434436,8 +434436,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -434458,8 +434458,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -434562,8 +434562,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -434786,8 +434786,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -434831,8 +434831,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -434880,8 +434880,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -434905,8 +434905,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -435117,7 +435117,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -435157,8 +435157,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -435983,8 +435983,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -436005,8 +436005,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -436109,8 +436109,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -436333,8 +436333,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -436378,8 +436378,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -436427,8 +436427,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -436452,8 +436452,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -436664,7 +436664,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -436704,8 +436704,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -437530,8 +437530,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -437552,8 +437552,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -437656,8 +437656,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -437880,8 +437880,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -437925,8 +437925,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -437974,8 +437974,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -437999,8 +437999,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -438211,7 +438211,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -438251,8 +438251,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -439077,8 +439077,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -439099,8 +439099,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -439203,8 +439203,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -439427,8 +439427,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -439472,8 +439472,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -439521,8 +439521,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -439546,8 +439546,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -439758,7 +439758,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -439798,8 +439798,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -440624,8 +440624,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -440646,8 +440646,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -440750,8 +440750,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -440974,8 +440974,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -441019,8 +441019,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -441068,8 +441068,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -441093,8 +441093,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -441305,7 +441305,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -441345,8 +441345,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -442171,8 +442171,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -442193,8 +442193,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -442297,8 +442297,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -442521,8 +442521,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -442566,8 +442566,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -442615,8 +442615,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -442640,8 +442640,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -442852,7 +442852,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -442892,8 +442892,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -443718,8 +443718,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -443740,8 +443740,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -443844,8 +443844,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -444068,8 +444068,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -444113,8 +444113,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -444162,8 +444162,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -444187,8 +444187,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -444399,7 +444399,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -444439,8 +444439,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -445265,8 +445265,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -445287,8 +445287,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -445391,8 +445391,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -445615,8 +445615,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -445660,8 +445660,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -445709,8 +445709,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -445734,8 +445734,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -445946,7 +445946,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -445986,8 +445986,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -446812,8 +446812,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -446834,8 +446834,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -446938,8 +446938,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -447162,8 +447162,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -447207,8 +447207,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -447256,8 +447256,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -447281,8 +447281,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -447493,7 +447493,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -447533,8 +447533,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -448359,8 +448359,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -448381,8 +448381,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -448485,8 +448485,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -448709,8 +448709,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -448754,8 +448754,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -448803,8 +448803,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -448828,8 +448828,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -449040,7 +449040,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -449080,8 +449080,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -449906,8 +449906,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -449928,8 +449928,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -450032,8 +450032,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -450256,8 +450256,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -450301,8 +450301,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -450350,8 +450350,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -450375,8 +450375,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -450587,7 +450587,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -450627,8 +450627,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -451453,8 +451453,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -451475,8 +451475,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -451579,8 +451579,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -451803,8 +451803,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -451848,8 +451848,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -451897,8 +451897,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -451922,8 +451922,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -452134,7 +452134,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -452174,8 +452174,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -453000,8 +453000,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -453022,8 +453022,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -453126,8 +453126,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -453350,8 +453350,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -453395,8 +453395,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -453444,8 +453444,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -453469,8 +453469,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -453681,7 +453681,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -453721,8 +453721,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -454547,8 +454547,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -454569,8 +454569,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -454673,8 +454673,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -454897,8 +454897,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -454942,8 +454942,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -454991,8 +454991,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -455016,8 +455016,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -455228,7 +455228,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -455268,8 +455268,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -456094,8 +456094,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -456116,8 +456116,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -456220,8 +456220,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -456444,8 +456444,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -456489,8 +456489,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -456538,8 +456538,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -456563,8 +456563,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -456775,7 +456775,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -456815,8 +456815,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -457641,8 +457641,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -457663,8 +457663,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -457767,8 +457767,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -457991,8 +457991,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -458036,8 +458036,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -458085,8 +458085,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -458110,8 +458110,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -458322,7 +458322,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -458362,8 +458362,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -459188,8 +459188,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -459210,8 +459210,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -459314,8 +459314,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -459538,8 +459538,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -459583,8 +459583,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -459632,8 +459632,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -459657,8 +459657,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -459869,7 +459869,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -459909,8 +459909,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -460735,8 +460735,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -460757,8 +460757,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -460861,8 +460861,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -461085,8 +461085,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -461130,8 +461130,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -461179,8 +461179,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -461204,8 +461204,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -461416,7 +461416,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -461456,8 +461456,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -462282,8 +462282,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -462304,8 +462304,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -462408,8 +462408,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -462632,8 +462632,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -462677,8 +462677,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -462726,8 +462726,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -462751,8 +462751,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -462963,7 +462963,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -463003,8 +463003,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -463829,8 +463829,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -463851,8 +463851,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -463955,8 +463955,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -464179,8 +464179,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -464224,8 +464224,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -464273,8 +464273,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -464298,8 +464298,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -464510,7 +464510,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -464550,8 +464550,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -465376,8 +465376,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -465398,8 +465398,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -465502,8 +465502,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -465726,8 +465726,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -465771,8 +465771,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -465820,8 +465820,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -465845,8 +465845,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -466057,7 +466057,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -466097,8 +466097,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -466923,8 +466923,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -466945,8 +466945,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -467049,8 +467049,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -467273,8 +467273,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -467318,8 +467318,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -467367,8 +467367,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -467392,8 +467392,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -467604,7 +467604,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -467644,8 +467644,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -468470,8 +468470,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -468492,8 +468492,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -468596,8 +468596,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -468820,8 +468820,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -468865,8 +468865,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -468914,8 +468914,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -468939,8 +468939,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -469151,7 +469151,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -469191,8 +469191,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -470017,8 +470017,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -470039,8 +470039,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -470143,8 +470143,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -470367,8 +470367,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -470412,8 +470412,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -470461,8 +470461,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -470486,8 +470486,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -470698,7 +470698,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -470738,8 +470738,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -471564,8 +471564,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -471586,8 +471586,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -471690,8 +471690,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -471914,8 +471914,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -471959,8 +471959,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -472008,8 +472008,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -472033,8 +472033,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -472245,7 +472245,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -472285,8 +472285,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -473111,8 +473111,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -473133,8 +473133,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -473237,8 +473237,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -473461,8 +473461,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -473506,8 +473506,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -473555,8 +473555,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -473580,8 +473580,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -473792,7 +473792,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -473832,8 +473832,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -474658,8 +474658,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -474680,8 +474680,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -474784,8 +474784,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -475008,8 +475008,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -475053,8 +475053,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -475102,8 +475102,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -475127,8 +475127,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -475339,7 +475339,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -475379,8 +475379,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -476205,8 +476205,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -476227,8 +476227,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -476331,8 +476331,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -476555,8 +476555,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -476600,8 +476600,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -476649,8 +476649,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -476674,8 +476674,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -476886,7 +476886,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -476926,8 +476926,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -477752,8 +477752,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -477774,8 +477774,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -477878,8 +477878,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -478102,8 +478102,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -478147,8 +478147,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -478196,8 +478196,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -478221,8 +478221,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -478433,7 +478433,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -478473,8 +478473,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -479299,8 +479299,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -479321,8 +479321,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -479425,8 +479425,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -479649,8 +479649,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -479694,8 +479694,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -479743,8 +479743,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -479768,8 +479768,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -479980,7 +479980,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -480020,8 +480020,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -480846,8 +480846,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -480868,8 +480868,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -480972,8 +480972,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -481196,8 +481196,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -481241,8 +481241,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -481290,8 +481290,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -481315,8 +481315,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -481527,7 +481527,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -481567,8 +481567,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -482393,8 +482393,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -482415,8 +482415,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -482519,8 +482519,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -482743,8 +482743,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -482788,8 +482788,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -482837,8 +482837,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -482862,8 +482862,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -483074,7 +483074,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -483114,8 +483114,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -483940,8 +483940,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -483962,8 +483962,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -484066,8 +484066,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -484290,8 +484290,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -484335,8 +484335,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -484384,8 +484384,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -484409,8 +484409,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -484621,7 +484621,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -484661,8 +484661,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -485487,8 +485487,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -485509,8 +485509,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -485613,8 +485613,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -485837,8 +485837,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -485882,8 +485882,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -485931,8 +485931,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -485956,8 +485956,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -486168,7 +486168,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -486208,8 +486208,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -487034,8 +487034,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -487056,8 +487056,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -487160,8 +487160,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -487384,8 +487384,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -487429,8 +487429,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -487478,8 +487478,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -487503,8 +487503,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -487715,7 +487715,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -487755,8 +487755,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -488581,8 +488581,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -488603,8 +488603,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -488707,8 +488707,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -488931,8 +488931,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -488976,8 +488976,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -489025,8 +489025,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -489050,8 +489050,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -489262,7 +489262,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -489302,8 +489302,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -490128,8 +490128,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -490150,8 +490150,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -490254,8 +490254,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -490478,8 +490478,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -490523,8 +490523,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -490572,8 +490572,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -490597,8 +490597,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -490809,7 +490809,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -490849,8 +490849,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -491675,8 +491675,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -491697,8 +491697,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -491801,8 +491801,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -492025,8 +492025,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -492070,8 +492070,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -492119,8 +492119,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -492144,8 +492144,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -492356,7 +492356,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -492396,8 +492396,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -493222,8 +493222,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -493244,8 +493244,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -493348,8 +493348,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -493572,8 +493572,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -493617,8 +493617,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -493666,8 +493666,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -493691,8 +493691,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -493903,7 +493903,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -493943,8 +493943,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -494769,8 +494769,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -494791,8 +494791,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -494895,8 +494895,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -495119,8 +495119,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -495164,8 +495164,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -495213,8 +495213,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -495238,8 +495238,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -495450,7 +495450,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -495490,8 +495490,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -496316,8 +496316,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -496338,8 +496338,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -496442,8 +496442,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -496666,8 +496666,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -496711,8 +496711,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -496760,8 +496760,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -496785,8 +496785,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -496997,7 +496997,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -497037,8 +497037,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -497863,8 +497863,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -497885,8 +497885,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -497989,8 +497989,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -498213,8 +498213,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -498258,8 +498258,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -498307,8 +498307,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -498332,8 +498332,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -498544,7 +498544,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -498584,8 +498584,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -499410,8 +499410,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -499432,8 +499432,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -499536,8 +499536,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -499760,8 +499760,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -499805,8 +499805,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -499854,8 +499854,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -499879,8 +499879,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -500091,7 +500091,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -500131,8 +500131,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -500957,8 +500957,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -500979,8 +500979,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -501083,8 +501083,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -501307,8 +501307,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -501352,8 +501352,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -501401,8 +501401,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -501426,8 +501426,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -501638,7 +501638,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -501678,8 +501678,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -502504,8 +502504,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -502526,8 +502526,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -502630,8 +502630,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -502854,8 +502854,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -502899,8 +502899,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -502948,8 +502948,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -502973,8 +502973,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -503185,7 +503185,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -503225,8 +503225,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -504051,8 +504051,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -504073,8 +504073,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -504177,8 +504177,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -504401,8 +504401,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -504446,8 +504446,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -504495,8 +504495,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -504520,8 +504520,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -504732,7 +504732,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -504772,8 +504772,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -505598,8 +505598,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -505620,8 +505620,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -505724,8 +505724,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -505948,8 +505948,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -505993,8 +505993,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -506042,8 +506042,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -506067,8 +506067,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -506279,7 +506279,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -506319,8 +506319,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -507145,8 +507145,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -507167,8 +507167,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -507271,8 +507271,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -507495,8 +507495,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -507540,8 +507540,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -507589,8 +507589,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -507614,8 +507614,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -507826,7 +507826,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -507866,8 +507866,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -508692,8 +508692,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -508714,8 +508714,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -508818,8 +508818,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -509042,8 +509042,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -509087,8 +509087,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -509136,8 +509136,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -509161,8 +509161,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -509373,7 +509373,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -509413,8 +509413,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -510239,8 +510239,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -510261,8 +510261,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -510365,8 +510365,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -510589,8 +510589,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -510634,8 +510634,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -510683,8 +510683,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -510708,8 +510708,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -510920,7 +510920,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -510960,8 +510960,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -511786,8 +511786,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -511808,8 +511808,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -511912,8 +511912,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -512136,8 +512136,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -512181,8 +512181,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -512230,8 +512230,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -512255,8 +512255,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -512467,7 +512467,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -512507,8 +512507,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -513333,8 +513333,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -513355,8 +513355,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -513459,8 +513459,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -513683,8 +513683,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -513728,8 +513728,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -513777,8 +513777,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -513802,8 +513802,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -514014,7 +514014,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -514054,8 +514054,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -514880,8 +514880,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -514902,8 +514902,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -515006,8 +515006,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -515230,8 +515230,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -515275,8 +515275,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -515324,8 +515324,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -515349,8 +515349,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -515561,7 +515561,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -515601,8 +515601,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -516427,8 +516427,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -516449,8 +516449,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -516553,8 +516553,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -516777,8 +516777,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -516822,8 +516822,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -516871,8 +516871,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -516896,8 +516896,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -517108,7 +517108,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -517148,8 +517148,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -517974,8 +517974,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -517996,8 +517996,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -518100,8 +518100,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -518324,8 +518324,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -518369,8 +518369,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -518418,8 +518418,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -518443,8 +518443,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -518655,7 +518655,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -518695,8 +518695,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -519521,8 +519521,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -519543,8 +519543,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -519647,8 +519647,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -519871,8 +519871,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -519916,8 +519916,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -519965,8 +519965,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -519990,8 +519990,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -520202,7 +520202,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -520242,8 +520242,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -521068,8 +521068,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -521090,8 +521090,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -521194,8 +521194,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -521418,8 +521418,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -521463,8 +521463,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -521512,8 +521512,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -521537,8 +521537,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -521749,7 +521749,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -521789,8 +521789,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -522615,8 +522615,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -522637,8 +522637,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -522741,8 +522741,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -522965,8 +522965,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -523010,8 +523010,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -523059,8 +523059,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -523084,8 +523084,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -523296,7 +523296,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -523336,8 +523336,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -524162,8 +524162,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -524184,8 +524184,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -524288,8 +524288,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -524512,8 +524512,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -524557,8 +524557,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -524606,8 +524606,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -524631,8 +524631,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -524843,7 +524843,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -524883,8 +524883,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -525709,8 +525709,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -525731,8 +525731,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -525835,8 +525835,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -526059,8 +526059,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -526104,8 +526104,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -526153,8 +526153,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -526178,8 +526178,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -526390,7 +526390,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -526430,8 +526430,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -527256,8 +527256,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -527278,8 +527278,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -527382,8 +527382,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -527606,8 +527606,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -527651,8 +527651,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -527700,8 +527700,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -527725,8 +527725,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -527937,7 +527937,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -527977,8 +527977,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -528803,8 +528803,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -528825,8 +528825,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -528929,8 +528929,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -529153,8 +529153,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -529198,8 +529198,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -529247,8 +529247,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -529272,8 +529272,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -529484,7 +529484,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -529524,8 +529524,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -530350,8 +530350,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -530372,8 +530372,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -530476,8 +530476,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -530700,8 +530700,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -530745,8 +530745,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -530794,8 +530794,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -530819,8 +530819,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -531031,7 +531031,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -531071,8 +531071,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -531897,8 +531897,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -531919,8 +531919,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -532023,8 +532023,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -532247,8 +532247,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -532292,8 +532292,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -532341,8 +532341,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -532366,8 +532366,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -532578,7 +532578,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -532618,8 +532618,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -533444,8 +533444,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -533466,8 +533466,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -533570,8 +533570,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -533794,8 +533794,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -533839,8 +533839,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -533888,8 +533888,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -533913,8 +533913,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -534125,7 +534125,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -534165,8 +534165,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -534991,8 +534991,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -535013,8 +535013,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -535117,8 +535117,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -535341,8 +535341,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -535386,8 +535386,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -535435,8 +535435,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -535460,8 +535460,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -535672,7 +535672,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -535712,8 +535712,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -536538,8 +536538,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -536560,8 +536560,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -536664,8 +536664,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -536888,8 +536888,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -536933,8 +536933,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -536982,8 +536982,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -537007,8 +537007,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -537219,7 +537219,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -537259,8 +537259,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -538085,8 +538085,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -538107,8 +538107,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -538211,8 +538211,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -538435,8 +538435,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -538480,8 +538480,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -538529,8 +538529,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -538554,8 +538554,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -538766,7 +538766,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -538806,8 +538806,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -539632,8 +539632,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -539654,8 +539654,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -539758,8 +539758,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -539982,8 +539982,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -540027,8 +540027,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -540076,8 +540076,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -540101,8 +540101,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -540313,7 +540313,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -540353,8 +540353,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -541179,8 +541179,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -541201,8 +541201,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -541305,8 +541305,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -541529,8 +541529,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -541574,8 +541574,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -541623,8 +541623,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -541648,8 +541648,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -541860,7 +541860,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -541900,8 +541900,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -542726,8 +542726,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -542748,8 +542748,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -542852,8 +542852,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -543076,8 +543076,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -543121,8 +543121,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -543170,8 +543170,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -543195,8 +543195,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -543407,7 +543407,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -543447,8 +543447,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -544273,8 +544273,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -544295,8 +544295,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -544399,8 +544399,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -544623,8 +544623,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -544668,8 +544668,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -544717,8 +544717,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -544742,8 +544742,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -544954,7 +544954,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -544994,8 +544994,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -545820,8 +545820,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -545842,8 +545842,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -545946,8 +545946,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -546170,8 +546170,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -546215,8 +546215,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -546264,8 +546264,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -546289,8 +546289,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -546501,7 +546501,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -546541,8 +546541,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -547367,8 +547367,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -547389,8 +547389,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -547493,8 +547493,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -547717,8 +547717,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -547762,8 +547762,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -547811,8 +547811,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -547836,8 +547836,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -548048,7 +548048,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -548088,8 +548088,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -548914,8 +548914,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -548936,8 +548936,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -549040,8 +549040,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -549264,8 +549264,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -549309,8 +549309,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -549358,8 +549358,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -549383,8 +549383,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -549595,7 +549595,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -549635,8 +549635,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -550461,8 +550461,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -550483,8 +550483,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -550587,8 +550587,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -550811,8 +550811,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -550856,8 +550856,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -550905,8 +550905,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -550930,8 +550930,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -551142,7 +551142,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -551182,8 +551182,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -552008,8 +552008,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -552030,8 +552030,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -552134,8 +552134,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -552358,8 +552358,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -552403,8 +552403,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -552452,8 +552452,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -552477,8 +552477,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -552689,7 +552689,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -552729,8 +552729,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -553555,8 +553555,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -553577,8 +553577,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -553681,8 +553681,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -553905,8 +553905,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -553950,8 +553950,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -553999,8 +553999,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -554024,8 +554024,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -554236,7 +554236,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -554276,8 +554276,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -555102,8 +555102,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -555124,8 +555124,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -555228,8 +555228,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -555452,8 +555452,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -555497,8 +555497,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -555546,8 +555546,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -555571,8 +555571,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -555783,7 +555783,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -555823,8 +555823,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -556649,8 +556649,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -556671,8 +556671,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -556775,8 +556775,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -556999,8 +556999,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -557044,8 +557044,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -557093,8 +557093,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -557118,8 +557118,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -557330,7 +557330,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -557370,8 +557370,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -558196,8 +558196,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -558218,8 +558218,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -558322,8 +558322,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -558546,8 +558546,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -558591,8 +558591,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -558640,8 +558640,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -558665,8 +558665,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -558877,7 +558877,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -558917,8 +558917,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -559743,8 +559743,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -559765,8 +559765,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -559869,8 +559869,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -560093,8 +560093,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -560138,8 +560138,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -560187,8 +560187,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -560212,8 +560212,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -560424,7 +560424,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -560464,8 +560464,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -561290,8 +561290,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -561312,8 +561312,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -561416,8 +561416,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -561640,8 +561640,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -561685,8 +561685,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -561734,8 +561734,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -561759,8 +561759,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -561971,7 +561971,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -562011,8 +562011,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -562837,8 +562837,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -562859,8 +562859,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -562963,8 +562963,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -563187,8 +563187,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -563232,8 +563232,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -563281,8 +563281,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -563306,8 +563306,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -563518,7 +563518,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -563558,8 +563558,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -564384,8 +564384,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -564406,8 +564406,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -564510,8 +564510,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -564734,8 +564734,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -564779,8 +564779,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -564828,8 +564828,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -564853,8 +564853,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -565065,7 +565065,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -565105,8 +565105,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -565931,8 +565931,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -565953,8 +565953,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -566057,8 +566057,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -566281,8 +566281,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -566326,8 +566326,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -566375,8 +566375,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -566400,8 +566400,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -566612,7 +566612,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -566652,8 +566652,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -567478,8 +567478,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -567500,8 +567500,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -567604,8 +567604,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -567828,8 +567828,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -567873,8 +567873,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -567922,8 +567922,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -567947,8 +567947,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -568159,7 +568159,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -568199,8 +568199,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -569025,8 +569025,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -569047,8 +569047,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -569151,8 +569151,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -569375,8 +569375,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -569420,8 +569420,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -569469,8 +569469,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -569494,8 +569494,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -569706,7 +569706,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -569746,8 +569746,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -570572,8 +570572,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -570594,8 +570594,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -570698,8 +570698,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -570922,8 +570922,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -570967,8 +570967,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -571016,8 +571016,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -571041,8 +571041,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -571253,7 +571253,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -571293,8 +571293,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -572119,8 +572119,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -572141,8 +572141,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -572245,8 +572245,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -572469,8 +572469,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -572514,8 +572514,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -572563,8 +572563,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -572588,8 +572588,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -572800,7 +572800,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -572840,8 +572840,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -573666,8 +573666,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -573688,8 +573688,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -573792,8 +573792,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -574016,8 +574016,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -574061,8 +574061,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -574110,8 +574110,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -574135,8 +574135,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -574347,7 +574347,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -574387,8 +574387,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -575213,8 +575213,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -575235,8 +575235,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -575339,8 +575339,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -575563,8 +575563,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -575608,8 +575608,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -575657,8 +575657,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -575682,8 +575682,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -575894,7 +575894,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -575934,8 +575934,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -576760,8 +576760,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -576782,8 +576782,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -576886,8 +576886,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -577110,8 +577110,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -577155,8 +577155,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -577204,8 +577204,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -577229,8 +577229,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -577441,7 +577441,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -577481,8 +577481,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -578307,8 +578307,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -578329,8 +578329,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -578433,8 +578433,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -578657,8 +578657,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -578702,8 +578702,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -578751,8 +578751,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -578776,8 +578776,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -578988,7 +578988,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -579028,8 +579028,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -579854,8 +579854,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -579876,8 +579876,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -579980,8 +579980,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -580204,8 +580204,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -580249,8 +580249,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -580298,8 +580298,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -580323,8 +580323,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -580535,7 +580535,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -580575,8 +580575,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -581401,8 +581401,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -581423,8 +581423,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -581527,8 +581527,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -581751,8 +581751,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -581796,8 +581796,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -581845,8 +581845,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -581870,8 +581870,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -582082,7 +582082,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -582122,8 +582122,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -582948,8 +582948,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -582970,8 +582970,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -583074,8 +583074,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -583298,8 +583298,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -583343,8 +583343,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -583392,8 +583392,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -583417,8 +583417,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -583629,7 +583629,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -583669,8 +583669,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -584495,8 +584495,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -584517,8 +584517,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -584621,8 +584621,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -584845,8 +584845,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -584890,8 +584890,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -584939,8 +584939,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -584964,8 +584964,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -585176,7 +585176,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -585216,8 +585216,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -586042,8 +586042,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -586064,8 +586064,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -586168,8 +586168,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -586325,7 +586325,7 @@
             "#096ed7"
         ],
         "minValue": 0,
-        "maxValue": 51
+        "maxValue": 52
     },
     "filters": {
         "platforms": [